UbuntuUpdates.org

Package "mosquitto"

Name: mosquitto

Description:

MQTT version 3.1/3.1.1 compatible message broker

Latest version: 1.4.15-2ubuntu0.18.04.3
Release: bionic (18.04)
Level: security
Repository: universe
Homepage: http://mosquitto.org/

Links

Save this URL for the latest version of "mosquitto": https://www.ubuntuupdates.org/mosquitto


Download "mosquitto"


Other versions of "mosquitto" in Bionic

Repository Area Version
base universe 1.4.15-2
updates universe 1.4.15-2ubuntu0.18.04.3

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.4.15-2ubuntu0.18.04.3 2019-06-20 17:06:25 UTC

  mosquitto (1.4.15-2ubuntu0.18.04.3) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS (client disconnect) via invalid UTF-8 strings
    - debian/patches/add-validate-utf8.patch: Add validate UTF-8
    - debian/patches/CVE-2017-7653.patch: Add UTF-8 tests, plus some validation
      fixes
    - CVE-2017-7653
  * SECURITY UPDATE: Memory leak in the Mosquitto Broker allows unauthenticated
    clients to send crafted CONNECT packets which could cause DoS
    - debian/patches/CVE-2017-7654.patch: Fix memory leak that could be caused
      by a malicious CONNECT packet
    - CVE-2017-7654

 -- Eduardo Barretto <email address hidden> Tue, 18 Jun 2019 11:42:22 -0300

Source diff to previous version
CVE-2017-7653 The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that
CVE-2017-7654 In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted

Version: 1.4.15-2ubuntu0.18.04.2 2019-02-14 12:06:59 UTC

  mosquitto (1.4.15-2ubuntu0.18.04.2) bionic-security; urgency=medium

  * Fix regression in update for CVE-2018-12546.

 -- <email address hidden> (Roger A. Light) Wed, 13 Feb 2019 00:27:01 +0000

Source diff to previous version

Version: 1.4.15-2ubuntu0.18.04.1 2019-02-11 15:06:27 UTC

  mosquitto (1.4.15-2ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: If Mosquitto is configured to use a password file for
    authentication, any malformed data in the password file will be treated as
    valid. This typically means that the malformed data becomes a username and
    no password. If this occurs, clients can circumvent authentication and get
    access to the broker by using the malformed username. In particular, a blank
    line will be treated as a valid empty username. Other security measures are
    unaffected. Users who have only used the mosquitto_passwd utility to create
    and modify their password files are unaffected by this vulnerability.
    - debian/patches/mosquitto-1.4.x-cve-2018-12551.patch: this fix introduces
      more stringent parsing tests on the password file data.
    - CVE-2018-12551
  * SECURITY UPDATE: If an ACL file is empty, or has only blank lines or
    comments, then mosquitto treats the ACL file as not being defined, which
    means that no topic access is denied. Although denying access to all
    topics is not a useful configuration, this behaviour is unexpected and
    could lead to access being incorrectly granted in some circumstances.
    - debian/patches/mosquitto-1.4.x-cve-2018-12550.patch: this fix ensures
      that if an ACL file is defined but no rules are defined, then access will
      be denied.
    - CVE-2018-12550
  * SECURITY UPDATE: If a client publishes a retained message to a topic that
    they have access to, and then their access to that topic is revoked, the
    retained message will still be delivered to future subscribers. This
    behaviour may be undesirable in some applications, so a configuration
    option `check_retain_source` has been introduced to enforce checking of
    the retained message source on publish.
    - debian/patches/mosquitto-1.4.15-cve-2018-12546.patch: this patch stores
      the originator of the retained message, so security checking can be
      carried out before re-publishing. The complexity of the patch is due to
      the need to save this information across broker restarts.
    - CVE-2018-12546

 -- <email address hidden> (Roger A. Light) Wed, 06 Feb 2019 17:03:31 +0000




About   -   Send Feedback to @ubuntu_updates