wsF5BAABCAAjFiEEB/gxf7d8Cd2OKhqJtvJJDhLM3JMFAmgGmVAFAwAAAAAACgkQtvJJDhLM3JMp
6RAA2EVtCrjV5HCpIAj9yEUQ//Szh681Yy13FV6XdSJaXnxt0FF+yVSkZqGlY119Xb8UuH0ML5ME
NouH68QQZ+VYX8jNfRddekXKYGDRlAVdYBJZv6GyWmh5k/nUmM8729Frv2x3pF4+5VYrGMrBt1El
JF3+n6MBzv/ve6QmVIV6UnJI7qto/Z99pmf9VnGqQxdDv/xRK/8VdZ7o7KULWiemcojAv9FTg21/
d4jCTKu6/BBgY7hQXsVWciz0V+RcFOf7dxb+NdN+XNYXZyTsL98AkVKR7zCVII4RWZuRMxlCpGwP
4cqnyowg9r9vDxBtzmJJWiRCcL1bickSgqW2zRqIG4IfOM15jG3i5zuU6INCH24fh9d6M44juDFy
ekc1BZZiW31yv40horKjPnzgteGpvJ0kVTc5kL01tiIeW/scZS4o8MVv+OVfx48BySg1oAtVc/OZ
Jr91tMivJGHiEPkYNHX2RvXDuK2+bBDfnZ8jr7AtBsnd9vnGDjX22qz0z1uIzVOlYv9aS2gWxill
bcjF6WT6Rfz6yIIYz/u0yHBkjyWa/4a/aBY+0R7Sn5efDGXTjtrdu8b5gkQBtiacQq72u7VwO0zg
9fWudZ7p2twPVfOTn3XE8xi93V5t6JfZmuZV1VRk1gluHFdPHHIPk5Re51Z0i0cbAi5bU16b4qe7
Ayo=
=Id26
-----END PGP SIGNATURE-----
========================================================================== Ubuntu Security Notice USN-7441-1 April 16, 2025 mosquitto vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Eclipse Mosquitto. Software Description: - mosquitto: MQTT compatible message broker Details: It was discovered that Eclipse Mosquitto client incorrectly handled memory when receiving a SUBACK packet. An attacker with a malicious broker could possibly use this issue to execute arbitrary code or cause a denial of service. (CVE-2024-10525) Xiangpu Song discovered that Eclipse Mosquitto broker did not properly manage memory under certain circumstances. A malicious client with a remote connection could possibly use this issue to cause the broker to crash resulting in a denial of service, or another unspecified impact. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3935) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS libmosquitto1 2.0.18-1ubuntu0.1~esm1 Available with Ubuntu Pro libmosquittopp1 2.0.18-1ubuntu0.1~esm1 Available with Ubuntu Pro mosquitto 2.0.18-1ubuntu0.1~esm1 Available with Ubuntu Pro mosquitto-clients 2.0.18-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS libmosquitto1 2.0.11-1ubuntu1.2 libmosquittopp1 2.0.11-1ubuntu1.2 mosquitto 2.0.11-1ubuntu1.2 mosquitto-clients 2.0.11-1ubuntu1.2 Ubuntu 20.04 LTS libmosquitto1 1.6.9-1ubuntu0.1~esm2 Available with Ubuntu Pro libmosquittopp1 1.6.9-1ubuntu0.1~esm2 Available with Ubuntu Pro mosquitto 1.6.9-1ubuntu0.1~esm2 Available with Ubuntu Pro mosquitto-clients 1.6.9-1ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS libmosquitto1 1.4.15-2ubuntu0.18.04.3+esm2 Available with Ubuntu Pro libmosquittopp1 1.4.15-2ubuntu0.18.04.3+esm2 Available with Ubuntu Pro mosquitto 1.4.15-2ubuntu0.18.04.3+esm2 Available with Ubuntu Pro mosquitto-clients 1.4.15-2ubuntu0.18.04.3+esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS libmosquitto1 1.4.8-1ubuntu0.16.04.7+esm2 Available with Ubuntu Pro libmosquittopp1 1.4.8-1ubuntu0.16.04.7+esm2 Available with Ubuntu Pro mosquitto 1.4.8-1ubuntu0.16.04.7+esm2 Available with Ubuntu Pro mosquitto-clients 1.4.8-1ubuntu0.16.04.7+esm2 Available with Ubuntu Pro Ubuntu 14.04 LTS libmosquitto0 0.15-2+deb7u3ubuntu0.1+esm1 Available with Ubuntu Pro libmosquittopp0 0.15-2+deb7u3ubuntu0.1+esm1 Available with Ubuntu Pro mosquitto 0.15-2+deb7u3ubuntu0.1+esm1 Available with Ubuntu Pro mosquitto-clients 0.15-2+deb7u3ubuntu0.1+esm1 Available with Ubuntu Pro python-mosquitto 0.15-2+deb7u3ubuntu0.1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7441-1 CVE-2024-10525, CVE-2024-3935 Package Information: https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1ubuntu1.2
No comments:
Post a Comment