[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 4059-1] mosquitto security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4059-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                          Abhijith PA
February 20, 2025                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : mosquitto
Version        : 2.0.11-1+deb11u2
CVE ID         : CVE-2024-3935 CVE-2024-10525


The following vulnerabilities have been discovered in the package
mosquitto, MQTT message broker.

CVE-2024-3935

    If a Mosquitto broker is configured to create an outgoing bridge
    connection, and that bridge connection has an incoming topic
    configured that makes use of topic remapping, then if the remote
    connection sends a crafted PUBLISH packet to the broker a double
    free will occur with a subsequent crash of the broker.
    

CVE-2024-10525

    If a malicious broker sends a crafted SUBACK packet with no reason
    codes, a client using libmosquitto may make out of bounds memory
    access when acting in its on_subscribe callback. This affects the
    mosquitto_sub and mosquitto_rr clients.
    

For Debian 11 bullseye, these problems have been fixed in version
2.0.11-1+deb11u2.

We recommend that you upgrade your mosquitto packages.

For the detailed security status of mosquitto please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mosquitto

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAme3B2QACgkQhj1N8u2c
KO/arA//T+7AHWkrYiD2moHqhwsSDqWeOUCIr2wicSVCRG5vA3aPBuBkQ9f43jBX
+zgn0KQxAEbpso2RH35/BcfX1g03WUm/K9jbXvymtf4qcrzwJjDr+hcdkM0rRCiO
RLaStdLrBR1WCH2TKKcTkMOJZTbCCKXOw3NnQj1d9yVHr7uXaPpeFRcmEQW8yR/u
6d7CMlAUjbgu4eFoDstjAN+fu0HqGYkO9ufXMQ+r2UcePZuMkiYA1GSTyU5k11hE
bqGguuPdi4EN7L0tfy9tFPj9eJ5daX6z5wFvBz+9COB+6pGVvFU5LX/yNunkoATE
mmEfHVKHs+4nXC4wgkPAOtRtCFYVm165TV+BlwnDDhWWqoE1DQXgk4B4OuDeWpfR
8UgneLU6Yi+DpEGl+Oo4IgXgJMGOSS5smZGqfVidQ3z6OUxm4azmHE/+WQWViL3M
cl61kGW9ml75pAICjPYwtmhoY+lXxJ1ABxnrGEq/FXbMuXysH4rdxtvCX988TmdI
//G8Epr6Fjh04t+t+em2SdFhKdcLr3XuRGzYWeEkA3mdFI//aTjI+qDlztZabVio
qzK+MNtNudUSVnk8aXI17SZ4Xun4kQhf67x2jjAovknyv78u4DCb9rtUbixkpmEk
j+/7w9zkafe25fGhgzeQvtAWRdoX7xW3UE++fI9TuiWmBDs/Chw=
=Fo6x
-----END PGP SIGNATURE-----


Reply to: