CVE-2023-2905: 
NixOS vulnerability analysis and mitigation

Cesanta Mongoose version 7.10, an embeddable web server, contains a heap-based buffer overflow vulnerability in its default configuration. The vulnerability stems from a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header. Version 7.9 and prior are not affected by this vulnerability. The issue was resolved in version 7.11 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write) and CWE-122 (Heap-based Buffer Overflow) (NVD).

The heap-based buffer overflow vulnerability could potentially lead to high impacts on confidentiality, integrity, and availability of the affected system. The CVSS score indicates that successful exploitation could result in complete compromise of system security (NVD).

Users are advised to upgrade to Mongoose version 7.11 or later, which contains the fix for this vulnerability. The fix was implemented to address the MQTT variable length issue (GitHub Release).