Description
In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Paho | 1.2.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.paho:org.eclipse.paho.client.mqttv3 | < 1.2.1 | 1.2.1 | GHSA-63qc-p2x4-9fgf |
Advisories 2
- WID-SEC-2025-2057 IBM App Connect Enterprise: Schwachstelle ermöglicht Darstellen falscher Informationen BSI CERT-Bund (WID) · Sep 15, 2025
- WID-SEC-2022-0617 IBM WebSphere Application Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2025