[SECURITY] [DLA 4059-1] mosquitto security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4059-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Abhijith PA
February 20, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : mosquitto
Version : 2.0.11-1+deb11u2
CVE ID : CVE-2024-3935 CVE-2024-10525
The following vulnerabilities have been discovered in the package
mosquitto, MQTT message broker.
CVE-2024-3935
If a Mosquitto broker is configured to create an outgoing bridge
connection, and that bridge connection has an incoming topic
configured that makes use of topic remapping, then if the remote
connection sends a crafted PUBLISH packet to the broker a double
free will occur with a subsequent crash of the broker.
CVE-2024-10525
If a malicious broker sends a crafted SUBACK packet with no reason
codes, a client using libmosquitto may make out of bounds memory
access when acting in its on_subscribe callback. This affects the
mosquitto_sub and mosquitto_rr clients.
For Debian 11 bullseye, these problems have been fixed in version
2.0.11-1+deb11u2.
We recommend that you upgrade your mosquitto packages.
For the detailed security status of mosquitto please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mosquitto
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAme3B2QACgkQhj1N8u2c
KO/arA//T+7AHWkrYiD2moHqhwsSDqWeOUCIr2wicSVCRG5vA3aPBuBkQ9f43jBX
+zgn0KQxAEbpso2RH35/BcfX1g03WUm/K9jbXvymtf4qcrzwJjDr+hcdkM0rRCiO
RLaStdLrBR1WCH2TKKcTkMOJZTbCCKXOw3NnQj1d9yVHr7uXaPpeFRcmEQW8yR/u
6d7CMlAUjbgu4eFoDstjAN+fu0HqGYkO9ufXMQ+r2UcePZuMkiYA1GSTyU5k11hE
bqGguuPdi4EN7L0tfy9tFPj9eJ5daX6z5wFvBz+9COB+6pGVvFU5LX/yNunkoATE
mmEfHVKHs+4nXC4wgkPAOtRtCFYVm165TV+BlwnDDhWWqoE1DQXgk4B4OuDeWpfR
8UgneLU6Yi+DpEGl+Oo4IgXgJMGOSS5smZGqfVidQ3z6OUxm4azmHE/+WQWViL3M
cl61kGW9ml75pAICjPYwtmhoY+lXxJ1ABxnrGEq/FXbMuXysH4rdxtvCX988TmdI
//G8Epr6Fjh04t+t+em2SdFhKdcLr3XuRGzYWeEkA3mdFI//aTjI+qDlztZabVio
qzK+MNtNudUSVnk8aXI17SZ4Xun4kQhf67x2jjAovknyv78u4DCb9rtUbixkpmEk
j+/7w9zkafe25fGhgzeQvtAWRdoX7xW3UE++fI9TuiWmBDs/Chw=
=Fo6x
-----END PGP SIGNATURE-----
Reply to: