* [Buildroot] [PATCH 1/1] mosquitto: security bump to version 1.5.3
@ 2018-09-28 21:22 Fabrice Fontaine
2018-10-05 19:49 ` Peter Korsgaard
0 siblings, 1 reply; 2+ messages in thread
From: Fabrice Fontaine @ 2018-09-28 21:22 UTC (permalink / raw)
To: buildroot
Fix CVE-2018-12543. If a message is sent to Mosquitto with a topic that
begins with $, but is not $SYS, then an assert that should be unreachable is
triggered and Mosquitto will exit.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
package/mosquitto/mosquitto.hash | 2 +-
package/mosquitto/mosquitto.mk | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/package/mosquitto/mosquitto.hash b/package/mosquitto/mosquitto.hash
index 96817d464d..b38830b8b5 100644
--- a/package/mosquitto/mosquitto.hash
+++ b/package/mosquitto/mosquitto.hash
@@ -1,5 +1,5 @@
# Locally calculated after checking gpg signature
-sha256 8557bc7ae34dfaf32a0fb56d2491b7a7f731269c88337227233013502df4d5b0 mosquitto-1.5.1.tar.gz
+sha256 3081a998d303a883b1cd064009beabc88aa9159e26f5258a4ae6007160491d10 mosquitto-1.5.3.tar.gz
# License files
sha256 cc77e25bafd40637b7084f04086d606f0a200051b61806f97c93405926670bc1 LICENSE.txt
diff --git a/package/mosquitto/mosquitto.mk b/package/mosquitto/mosquitto.mk
index 7ac6487488..1d72f9b16e 100644
--- a/package/mosquitto/mosquitto.mk
+++ b/package/mosquitto/mosquitto.mk
@@ -4,7 +4,7 @@
#
################################################################################
-MOSQUITTO_VERSION = 1.5.1
+MOSQUITTO_VERSION = 1.5.3
MOSQUITTO_SITE = https://mosquitto.org/files/source
MOSQUITTO_LICENSE = EPL-1.0 or EDLv1.0
MOSQUITTO_LICENSE_FILES = LICENSE.txt epl-v10 edl-v10
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [Buildroot] [PATCH 1/1] mosquitto: security bump to version 1.5.3
2018-09-28 21:22 [Buildroot] [PATCH 1/1] mosquitto: security bump to version 1.5.3 Fabrice Fontaine
@ 2018-10-05 19:49 ` Peter Korsgaard
0 siblings, 0 replies; 2+ messages in thread
From: Peter Korsgaard @ 2018-10-05 19:49 UTC (permalink / raw)
To: buildroot
>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:
> Fix CVE-2018-12543. If a message is sent to Mosquitto with a topic that
> begins with $, but is not $SYS, then an assert that should be unreachable is
> triggered and Mosquitto will exit.
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Committed to 2018.08.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-10-05 19:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-09-28 21:22 [Buildroot] [PATCH 1/1] mosquitto: security bump to version 1.5.3 Fabrice Fontaine
2018-10-05 19:49 ` Peter Korsgaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox