Is CVE-2020-13410 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-13410 being exploited in the wild.

How severe is CVE-2020-13410?

Low severity, with a CVSS score of 3.1, published 6 May 2021.

Which products and versions are affected?

aedes (npm) SEMVER:introduced=0,fixed=0.42.1.

Is there a fix for CVE-2020-13410?

Yes. aedes (npm): upgrade to 0.42.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-13410 attacked?

It is attacked over the network.

Am I affected by CVE-2020-13410?

Check whether you run aedes (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-13410: Aedes improper exception handling in packet write

CVE-2020-13410 · Severity: low · CVSS 3.1 · Published 2021-05-06

Aedes is an open-source MQTT broker used to manage message queuing in IoT and real-time applications. A flaw in the packet writing logic fails to properly handle exceptions, allowing an attacker to send malformed packets that cause the broker to crash, leading to service unavailability.

Technologies: aedes (npm). Vendors: npm.

Quick answers

Is CVE-2020-13410 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-13410 being exploited in the wild.
How severe is CVE-2020-13410?: Low severity, with a CVSS score of 3.1, published 6 May 2021.
Which products and versions are affected?: aedes (npm) SEMVER:introduced=0,fixed=0.42.1.
Is there a fix for CVE-2020-13410?: Yes. aedes (npm): upgrade to 0.42.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-13410 attacked?: It is attacked over the network.
Am I affected by CVE-2020-13410?: Check whether you run aedes (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aedes (npm): upgrade to 0.42.1 or later
```
npm install aedes@0.42.1
```

Technical details

The vulnerability exists in lib/write.js of Aedes versions prior to 0.42.1, where exceptions occurring during packet writes to a stream are not properly caught or handled (CWE-755: Improper Handling of Exceptional Conditions). An attacker can send a specially crafted invalid MQTT packet over the network to trigger an unhandled exception. No authentication or user interaction is required since MQTT protocol handling occurs at the network layer. A successful exploit crashes the broker process, resulting in denial of service. The fix was released in version 0.42.1.

Affected products

MoscaJS Aedes < 0.42.1

Identifiers

CVE-2020-13410
GHSA-gh78-48h3-frjq

Timeline

2020-08-26: disclosed
2020-05-25: patched

References

https://github.com/moscajs/aedes/pull/493

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.