Monday, April 21, 2025

[USN-7441-1] Eclipse Mosquitto vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEB/gxf7d8Cd2OKhqJtvJJDhLM3JMFAmgGmVAFAwAAAAAACgkQtvJJDhLM3JMp
6RAA2EVtCrjV5HCpIAj9yEUQ//Szh681Yy13FV6XdSJaXnxt0FF+yVSkZqGlY119Xb8UuH0ML5ME
NouH68QQZ+VYX8jNfRddekXKYGDRlAVdYBJZv6GyWmh5k/nUmM8729Frv2x3pF4+5VYrGMrBt1El
JF3+n6MBzv/ve6QmVIV6UnJI7qto/Z99pmf9VnGqQxdDv/xRK/8VdZ7o7KULWiemcojAv9FTg21/
d4jCTKu6/BBgY7hQXsVWciz0V+RcFOf7dxb+NdN+XNYXZyTsL98AkVKR7zCVII4RWZuRMxlCpGwP
4cqnyowg9r9vDxBtzmJJWiRCcL1bickSgqW2zRqIG4IfOM15jG3i5zuU6INCH24fh9d6M44juDFy
ekc1BZZiW31yv40horKjPnzgteGpvJ0kVTc5kL01tiIeW/scZS4o8MVv+OVfx48BySg1oAtVc/OZ
Jr91tMivJGHiEPkYNHX2RvXDuK2+bBDfnZ8jr7AtBsnd9vnGDjX22qz0z1uIzVOlYv9aS2gWxill
bcjF6WT6Rfz6yIIYz/u0yHBkjyWa/4a/aBY+0R7Sn5efDGXTjtrdu8b5gkQBtiacQq72u7VwO0zg
9fWudZ7p2twPVfOTn3XE8xi93V5t6JfZmuZV1VRk1gluHFdPHHIPk5Re51Z0i0cbAi5bU16b4qe7
Ayo=
=Id26
-----END PGP SIGNATURE-----

==========================================================================  Ubuntu Security Notice USN-7441-1  April 16, 2025    mosquitto vulnerabilities  ==========================================================================    A security issue affects these releases of Ubuntu and its derivatives:    - Ubuntu 24.04 LTS  - Ubuntu 22.04 LTS  - Ubuntu 20.04 LTS  - Ubuntu 18.04 LTS  - Ubuntu 16.04 LTS  - Ubuntu 14.04 LTS    Summary:    Several security issues were fixed in Eclipse Mosquitto.    Software Description:  - mosquitto: MQTT compatible message broker    Details:    It was discovered that Eclipse Mosquitto client incorrectly handled  memory when receiving a SUBACK packet. An attacker with a malicious  broker could possibly use this issue to execute arbitrary code or  cause a denial of service. (CVE-2024-10525)    Xiangpu Song discovered that Eclipse Mosquitto broker did not properly  manage memory under certain circumstances. A malicious client with a  remote connection could possibly use this issue to cause the broker to  crash resulting in a denial of service, or another unspecified impact.  This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.  (CVE-2024-3935)    Update instructions:    The problem can be corrected by updating your system to the following  package versions:    Ubuntu 24.04 LTS    libmosquitto1                   2.0.18-1ubuntu0.1~esm1                                    Available with Ubuntu Pro    libmosquittopp1                 2.0.18-1ubuntu0.1~esm1                                    Available with Ubuntu Pro    mosquitto                       2.0.18-1ubuntu0.1~esm1                                    Available with Ubuntu Pro    mosquitto-clients               2.0.18-1ubuntu0.1~esm1                                    Available with Ubuntu Pro    Ubuntu 22.04 LTS    libmosquitto1                   2.0.11-1ubuntu1.2    libmosquittopp1                 2.0.11-1ubuntu1.2    mosquitto                       2.0.11-1ubuntu1.2    mosquitto-clients               2.0.11-1ubuntu1.2    Ubuntu 20.04 LTS    libmosquitto1                   1.6.9-1ubuntu0.1~esm2                                    Available with Ubuntu Pro    libmosquittopp1                 1.6.9-1ubuntu0.1~esm2                                    Available with Ubuntu Pro    mosquitto                       1.6.9-1ubuntu0.1~esm2                                    Available with Ubuntu Pro    mosquitto-clients               1.6.9-1ubuntu0.1~esm2                                    Available with Ubuntu Pro    Ubuntu 18.04 LTS    libmosquitto1                   1.4.15-2ubuntu0.18.04.3+esm2                                    Available with Ubuntu Pro    libmosquittopp1                 1.4.15-2ubuntu0.18.04.3+esm2                                    Available with Ubuntu Pro    mosquitto                       1.4.15-2ubuntu0.18.04.3+esm2                                    Available with Ubuntu Pro    mosquitto-clients               1.4.15-2ubuntu0.18.04.3+esm2                                    Available with Ubuntu Pro    Ubuntu 16.04 LTS    libmosquitto1                   1.4.8-1ubuntu0.16.04.7+esm2                                    Available with Ubuntu Pro    libmosquittopp1                 1.4.8-1ubuntu0.16.04.7+esm2                                    Available with Ubuntu Pro    mosquitto                       1.4.8-1ubuntu0.16.04.7+esm2                                    Available with Ubuntu Pro    mosquitto-clients               1.4.8-1ubuntu0.16.04.7+esm2                                    Available with Ubuntu Pro    Ubuntu 14.04 LTS    libmosquitto0                   0.15-2+deb7u3ubuntu0.1+esm1                                    Available with Ubuntu Pro    libmosquittopp0                 0.15-2+deb7u3ubuntu0.1+esm1                                    Available with Ubuntu Pro    mosquitto                       0.15-2+deb7u3ubuntu0.1+esm1                                    Available with Ubuntu Pro    mosquitto-clients               0.15-2+deb7u3ubuntu0.1+esm1                                    Available with Ubuntu Pro    python-mosquitto                0.15-2+deb7u3ubuntu0.1+esm1                                    Available with Ubuntu Pro    In general, a standard system update will make all the necessary changes.    References:    https://ubuntu.com/security/notices/USN-7441-1    CVE-2024-10525, CVE-2024-3935    Package Information:    https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1ubuntu1.2    

No comments:

Post a Comment