From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter Korsgaard Date: Wed, 18 Sep 2019 17:42:12 +0200 Subject: [Buildroot] [PATCH] package/mosquitto: security bump to version 1.6.6 In-Reply-To: (Titouan Christophe's message of "Wed, 18 Sep 2019 17:02:02 +0200") References: <20190918143840.19328-1-peter@korsgaard.com> Message-ID: <87muf11ui3.fsf@dell.be.48ers.dk> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: buildroot@busybox.net >>>>> "Titouan" == Titouan Christophe writes: > Hello Peter and all, > On 9/18/19 4:38 PM, Peter Korsgaard wrote: >> Fixes a security issue. From the annoncement: >> >> A vulnerability exists in Mosquitto versions 1.5 to 1.6.5 inclusive. >> >> If a client sends a SUBSCRIBE packet containing a topic that consists of >> approximately 65400 or more '/' characters, i.e. the topic hierarchy >> separator, then a stack overflow will occur. >> >> The issue is fixed in Mosquitto 1.6.6 and 1.5.9. Patches for older versions >> are available at https://mosquitto.org/files/cve/2019-hier >> >> The fix addresses the problem by restricting the allowed number of topic >> hierarchy levels to 200. An alternative fix is to increase the size of the >> stack by a small amount. >> >> https://mosquitto.org/blog/2019/09/version-1-6-6-released/ >> >> Also notice that 1.6.5 silently fixed a security issue: >> >> CVE-2019-11778 >> >> A vulnerability exists in Mosquitto version 1.6 to 1.6.4 inclusive, known as CVE-2019-11778 >> >> If an MQTT v5 client connects to Mosquitto, sets a last will and testament, >> sets a will delay interval, sets a session expiry interval, and the will >> delay interval is set longer than the session expiry interval, then a use >> after free error occurs, which has the potential to cause a crash in some >> situations. >> > Do you also intend to backport this into 2019.02 ? Yes, but 2019.02.x uses 1.5.8, so there it makes more sense to move to 1.5.9. -- Bye, Peter Korsgaard