From 5baee87529e462e477cd6a1685cf3ad201ce332a Mon Sep 17 00:00:00 2001 From: Craig Leres Date: Sat, 24 Jul 2021 09:59:42 -0700 Subject: [PATCH] security/vuxml: Mark mosquitto >= 2.0.0, < 2.0.10 vulnerable as per: https://github.com/eclipse/mosquitto/blob/d5ecd9f5aa98d42e7549eea09a71a23eef241f31/ChangeLog.txt - If an authenticated client connected with MQTT v5 sent a malformed CONNACK message to the broker a NULL pointer dereference occurred, most likely resulting in a segfault. PR: 255229 Reported by: Daniel Engberg --- security/vuxml/vuln-2021.xml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index f8bb8cf5a2b4..b10f789df286 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,34 @@ + + mosquitto -- NULL pointer dereference + + + mosquitto + 2.0.02.0.10 + + + + +

Roger Light reports:

+
+

If an authenticated client connected with MQTT v5 sent + a malformed CONNACK message to the broker a NULL pointer + dereference occurred, most likely resulting in a + segfault.

+

(Note: a CVE is referenced in the github commit but it + appears to be for a python-bleach vulnerability so it is + not included here.)

+
+ + + + https://github.com/eclipse/mosquitto/blob/d5ecd9f5aa98d42e7549eea09a71a23eef241f31/ChangeLog.txt + + + 2021-04-10 + 2021-07-24 + + + pjsip -- Race condition in SSL socket server