DSA-5511-1 mosquitto -- security update

Debian Security Advisory

DSA-5511-1 mosquitto -- security update

Date Reported:

01 Oct 2023

Affected Packages:

mosquitto

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 993400, Bug 1001028.
In Mitre's CVE dictionary: CVE-2021-34434, CVE-2023-0809, CVE-2023-3592, CVE-2023-28366, CVE-2021-41039.

More information:

Several security vulnerabilities have been discovered in mosquitto, a MQTT compatible message broker, which may be abused for a denial of service attack.

• CVE-2021-34434

  In Eclipse Mosquitto when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a durable client is offline, then existing subscriptions for that client are not revoked.

• CVE-2023-0809

  Fix excessive memory being allocated based on malicious initial packets that are not CONNECT packets.

• CVE-2023-3592

  Fix memory leak when clients send v5 CONNECT packets with a will message that contains invalid property types.

• CVE-2023-28366

  The broker in Eclipse Mosquitto has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.

Additionally CVE-2021-41039 has been fixed for Debian 11 Bullseye.

• CVE-2021-41039

  An MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, leading to a loss of performance and possible denial of service.

For the oldstable distribution (bullseye), these problems have been fixed in version 2.0.11-1+deb11u1.

For the stable distribution (bookworm), these problems have been fixed in version 2.0.11-1.2+deb12u1.

We recommend that you upgrade your mosquitto packages.

For the detailed security status of mosquitto please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mosquitto