kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

security/vuxml: Mark mosquitto >= 2.0.0, < 2.0.10 vulnerable as per:

Browse source 
d5ecd9f5aa/ChangeLog.txt

 - If an authenticated client connected with MQTT v5 sent a malformed
   CONNACK message to the broker a NULL pointer dereference occurred,
   most likely resulting in a segfault.

PR:		255229
Reported by:	Daniel Engberg
This commit is contained in:
Craig Leres 2021-07-24 09:59:42 -07:00
parent c2491d8377
commit 5baee87529
1 changed files with 31 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
security/vuxml/vuln-2021.xml
View file

@ -1,3 +1,34 @@
<vuln vid="cc553d79-e1f0-4b94-89f2-bacad42ee826">
<topic>mosquitto -- NULL pointer dereference</topic>
<affects>
<package>
<name>mosquitto</name>
<range><ge>2.0.0</ge><lt>2.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roger Light reports:</p>
<blockquote cite="https://github.com/eclipse/mosquitto/blob/d5ecd9f5aa98d42e7549eea09a71a23eef241f31/ChangeLog.txt">
<p>If an authenticated client connected with MQTT v5 sent
a malformed CONNACK message to the broker a NULL pointer
dereference occurred, most likely resulting in a
segfault.</p>
<p>(Note: a CVE is referenced in the github commit but it
appears to be for a python-bleach vulnerability so it is
not included here.)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/eclipse/mosquitto/blob/d5ecd9f5aa98d42e7549eea09a71a23eef241f31/ChangeLog.txt</url>
</references>
<dates>
<discovery>2021-04-10</discovery>
<entry>2021-07-24</entry>
</dates>
</vuln>
<vuln vid="92ad12b8-ec09-11eb-aef1-0897988a1c07">
<topic>pjsip -- Race condition in SSL socket server</topic>
<affects>