CVE-2021-34432: 
NixOS vulnerability analysis and mitigation

CVE-2021-34432 affects Eclipse Mosquitto versions 2.0.0 through 2.0.7. The vulnerability was discovered on June 10, 2021, and involves a server crash condition when a client sends a PUBLISH packet with a topic length of 0. This security issue specifically impacts the MQTT broker functionality in Eclipse Mosquitto (Eclipse Bug).

The vulnerability occurs when a client attempts to send a PUBLISH packet with a topic length set to 0, which causes the Mosquitto server to crash. The issue has a CVSS 3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability can be triggered remotely and requires no special privileges or user interaction (Ubuntu CVE).

When exploited, this vulnerability results in a denial of service condition by causing the Mosquitto server to crash. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (Rapid7).

The vulnerability can be exploited remotely by sending a specially crafted MQTT packet to the server. A proof of concept exists that demonstrates the exploit using a simple network command (Eclipse Bug).

The vulnerability was fixed in Eclipse Mosquitto version 2.0.8 through a patch that addresses the topic length validation. The fix was implemented in commit 9b08faf0bdaf5a4f2e6e3dd1ea7e8c57f70418d6. Users are advised to upgrade to version 2.0.8 or later to mitigate this vulnerability (Debian Security).