GHSA-63qc-p2x4-9fgf
Suggest an improvement- Source
- https://github.com/advisories/GHSA-63qc-p2x4-9fgf
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-63qc-p2x4-9fgf/GHSA-63qc-p2x4-9fgf.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-63qc-p2x4-9fgf
- Aliases
- Published
- 2019-09-17T22:47:11Z
- Modified
- 2023-11-08T04:01:01.949579Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library
- Details
-
In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.
- Database specific
{ "nvd_published_at": "2019-09-11T18:15:00Z", "github_reviewed_at": "2019-09-13T21:47:04Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-346", "CWE-755" ] }- References
Affected packages
Maven / org.eclipse.paho:org.eclipse.paho.client.mqttv3
Package
- Name
- org.eclipse.paho:org.eclipse.paho.client.mqttv3
- View open source insights on deps.dev
- Purl
- pkg:maven/org.eclipse.paho/org.eclipse.paho.client.mqttv3