DATABASE RESOURCES PRICING ABOUT US

{"id": "UBUNTU_USN-4137-1.NASL", "type": "nessus", "bulletinFamily": "scanner", "title": "Ubuntu 19.04 : Mosquitto vulnerability (USN-4137-1)", "description": "It was discovered that Mosquitto incorrectly handled certain specially crafted input and network packets. A remote attacker could use this to cause a denial of service.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2019-09-24T00:00:00", "modified": "2019-12-24T00:00:00", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, "cvss2": {}, "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "href": "https://www.tenable.com/plugins/nessus/129290", "reporter": "Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://usn.ubuntu.com/4137-1/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11779"], "cvelist": ["CVE-2019-11779"], "immutableFields": [], "lastseen": "2021-08-19T12:19:30", "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "checkpoint_advisories", "idList": ["CPAI-2019-1684"]}, {"type": "cve", "idList": ["CVE-2019-11779"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1972-1:5A176", "DEBIAN:DSA-4570-1:91EE2", "DEBIAN:DSA-4570-1:EDA9B"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2019-11779"]}, {"type": "fedora", "idList": ["FEDORA:2D772634EB70", "FEDORA:B767D633F125", "FEDORA:EF6A1633F10B"]}, {"type": "nessus", "idList": ["DEBIAN_DLA-1972.NASL", "DEBIAN_DSA-4570.NASL", "FEDORA_2019-4C69FB4CD7.NASL", "FEDORA_2019-8B83C261DD.NASL", "FEDORA_2019-D99E2329CB.NASL", "OPENSUSE-2019-2206.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310704570", "OPENVAS:1361412562310844183", "OPENVAS:1361412562310852812", "OPENVAS:1361412562310876880", "OPENVAS:1361412562310876881", "OPENVAS:1361412562310877257", "OPENVAS:1361412562310891972"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2019:2206-1", "OPENSUSE-SU-2019:2247-1"]}, {"type": "ubuntu", "idList": ["USN-4137-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2019-11779"]}], "rev": 4}, "score": {"value": 6.0, "vector": "NONE"}, "backreferences": {"references": [{"type": "checkpoint_advisories", "idList": ["CPAI-2019-1684"]}, {"type": "cve", "idList": ["CVE-2019-11779"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1972-1:5A176"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2019-11779"]}, {"type": "fedora", "idList": ["FEDORA:2D772634EB70", "FEDORA:B767D633F125", "FEDORA:EF6A1633F10B"]}, {"type": "nessus", "idList": ["FEDORA_2019-4C69FB4CD7.NASL", "FEDORA_2019-8B83C261DD.NASL", "FEDORA_2019-D99E2329CB.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310844183", "OPENVAS:1361412562310876880", "OPENVAS:1361412562310876881", "OPENVAS:1361412562310891972"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2019:2206-1", "OPENSUSE-SU-2019:2247-1"]}, {"type": "ubuntu", "idList": ["USN-4137-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2019-11779"]}]}, "exploitation": null, "vulnersScore": 6.0}, "pluginID": "129290", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4137-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129290);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/12/24\");\n\n script_cve_id(\"CVE-2019-11779\");\n script_xref(name:\"USN\", value:\"4137-1\");\n\n script_name(english:\"Ubuntu 19.04 : Mosquitto vulnerability (USN-4137-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that Mosquitto incorrectly handled certain specially\ncrafted input and network packets. A remote attacker could use this to\ncause a denial of service.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4137-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libmosquitto1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libmosquittopp1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:mosquitto-clients\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:19.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/24\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(19\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 19.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"19.04\", pkgname:\"libmosquitto1\", pkgver:\"1.5.7-1ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"libmosquittopp1\", pkgver:\"1.5.7-1ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"mosquitto\", pkgver:\"1.5.7-1ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"mosquitto-clients\", pkgver:\"1.5.7-1ubuntu0.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libmosquitto1 / libmosquittopp1 / mosquitto / mosquitto-clients\");\n}\n", "naslFamily": "Ubuntu Local Security Checks", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libmosquitto1", "p-cpe:/a:canonical:ubuntu_linux:libmosquittopp1", "p-cpe:/a:canonical:ubuntu_linux:mosquitto", "p-cpe:/a:canonical:ubuntu_linux:mosquitto-clients", "cpe:/o:canonical:ubuntu_linux:19.04"], "solution": "Update the affected packages.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {"risk factor": "Low", "score": "3.6"}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2019-09-23T00:00:00", "vulnerabilityPublicationDate": "2019-09-19T00:00:00", "exploitableWith": [], "_state": {"dependencies": 1645715076}}

{"checkpoint_advisories": [{"lastseen": "2021-12-17T11:17:23", "description": "A stack overflow exists in Eclipse Mosquitto. The vulnerability is due to insufficient handling of the Topic in MQTT SUBSCRIBE messages. A remote attacker can exploit this vulnerability by sending a crafted MQTT SUBSCRIBE message with a large number of topic hierarchy separators in the topic. Successful exploitation could result in denial of service conditions on the server process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2020-03-01T00:00:00", "type": "checkpoint_advisories", "title": "Eclipse Mosquitto Denial Of Service (CVE-2019-11779)", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2020-03-01T00:00:00", "id": "CPAI-2019-1684", "href": "", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "debian": [{"lastseen": "2022-02-16T12:04:43", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4570-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nNovember 17, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : mosquitto\nCVE ID : CVE-2019-11779\nDebian Bug : 940654\n\nA vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1\ncompatible message broker, allowing a malicious MQTT client to cause a\ndenial of service (stack overflow and daemon crash), by sending a\nspecially crafted SUBSCRIBE packet containing a topic with a extremely\ndeep hierarchy.\n\nFor the stable distribution (buster), this problem has been fixed in\nversion 1.5.7-1+deb10u1.\n\nWe recommend that you upgrade your mosquitto packages.\n\nFor the detailed security status of mosquitto please refer to its\nsecurity tracker page at:\nhttps://security-tracker.debian.org/tracker/mosquitto\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-11-17T16:13:12", "type": "debian", "title": "[SECURITY] [DSA 4570-1] mosquitto security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-11-17T16:13:12", "id": "DEBIAN:DSA-4570-1:91EE2", "href": "https://lists.debian.org/debian-security-announce/2019/msg00222.html", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-10-23T08:50:23", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4570-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nNovember 17, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : mosquitto\nCVE ID : CVE-2019-11779\nDebian Bug : 940654\n\nA vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1\ncompatible message broker, allowing a malicious MQTT client to cause a\ndenial of service (stack overflow and daemon crash), by sending a\nspecially crafted SUBSCRIBE packet containing a topic with a extremely\ndeep hierarchy.\n\nFor the stable distribution (buster), this problem has been fixed in\nversion 1.5.7-1+deb10u1.\n\nWe recommend that you upgrade your mosquitto packages.\n\nFor the detailed security status of mosquitto please refer to its\nsecurity tracker page at:\nhttps://security-tracker.debian.org/tracker/mosquitto\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-11-17T16:13:12", "type": "debian", "title": "[SECURITY] [DSA 4570-1] mosquitto security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-11-17T16:13:12", "id": "DEBIAN:DSA-4570-1:EDA9B", "href": "https://lists.debian.org/debian-security-announce/2019/msg00222.html", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-12-20T15:30:38", "description": "Package : mosquitto\nVersion : 1.3.4-2+deb8u4\nCVE ID : CVE-2017-7655 CVE-2018-12550 CVE-2018-12551\n CVE-2019-11779\n\n\nSeveral issues have been found in mosquitto, a MQTT version 3.1/3.1.1 \ncompatible message broker.\n\n\nCVE-2017-7655\n\n A Null dereference vulnerability in the Mosquitto library could\n lead to crashes for those applications using the library.\n\n\nCVE-2018-12550\n\n An ACL file with no statements was treated as having a default\n allow policy. The new behaviour of an empty ACL file is a default\n policy of access denied.\n (this is in compliance with all newer releases)\n\n\nCVE-2018-12551\n\n Malformed authentication data in the password file could allow\n clients to circumvent authentication and get access to the broker.\n\n\nCVE-2019-11779\n\n Fix for processing a crafted SUBSCRIBE packet containing a topic\n that consists of approximately 65400 or more &#x27;/&#x27; characters.\n (setting TOPIC_HIERARCHY_LIMIT to 200)\n\n\nFor Debian 8 &quot;Jessie&quot;, these problems have been fixed in version\n1.3.4-2+deb8u4.\n\nWe recommend that you upgrade your mosquitto packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-10-26T21:33:17", "type": "debian", "title": "[SECURITY] [DLA 1972-1] mosquitto security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7655", "CVE-2018-12550", "CVE-2018-12551", "CVE-2019-11779"], "modified": "2019-10-26T21:33:17", "id": "DEBIAN:DLA-1972-1:5A176", "href": "https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "suse": [{"lastseen": "2022-04-18T12:41:45", "description": "An update that fixes one vulnerability is now available.\n\nDescription:\n\n This update for mosquitto fixes the following issues:\n\n - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that\n could lead to a stack overflow (bsc#1151494).\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.1:\n\n zypper in -t patch openSUSE-2019-2206=1", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-09-28T00:00:00", "type": "suse", "title": "Security update for mosquitto (moderate)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-09-28T00:00:00", "id": "OPENSUSE-SU-2019:2206-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P6G5KTRFNUICAFNG2F4INONW2KV5YBAK/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2022-06-23T18:01:21", "description": "An update that fixes one vulnerability is now available.\n\nDescription:\n\n This update for mosquitto fixes the following issues:\n\n - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that\n could lead to a stack overflow (bsc#1151494).\n\n This update was imported from the openSUSE:Leap:15.1:Update update project.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Backports SLE-15-SP1:\n\n zypper in -t patch openSUSE-2019-2247=1", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-10-03T00:00:00", "type": "suse", "title": "Security update for mosquitto (moderate)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-10-03T00:00:00", "id": "OPENSUSE-SU-2019:2247-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HM4BH6TF6Y33PDPP5RQIILYN7TCGMPWW/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "nessus": [{"lastseen": "2021-10-16T12:41:53", "description": "This update for mosquitto fixes the following issues :\n\n - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that could lead to a stack overflow (bsc#1151494).", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-09-30T00:00:00", "type": "nessus", "title": "openSUSE Security Update : mosquitto (openSUSE-2019-2206)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-12-23T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libmosquitto1", "p-cpe:/a:novell:opensuse:libmosquitto1-debuginfo", "p-cpe:/a:novell:opensuse:libmosquittopp1", "p-cpe:/a:novell:opensuse:libmosquittopp1-debuginfo", "p-cpe:/a:novell:opensuse:mosquitto", "p-cpe:/a:novell:opensuse:mosquitto-clients", "p-cpe:/a:novell:opensuse:mosquitto-clients-debuginfo", "p-cpe:/a:novell:opensuse:mosquitto-debuginfo", "p-cpe:/a:novell:opensuse:mosquitto-debugsource", "p-cpe:/a:novell:opensuse:mosquitto-devel", "cpe:/o:novell:opensuse:15.1"], "id": "OPENSUSE-2019-2206.NASL", "href": "https://www.tenable.com/plugins/nessus/129458", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-2206.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129458);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/12/23\");\n\n script_cve_id(\"CVE-2019-11779\");\n\n script_name(english:\"openSUSE Security Update : mosquitto (openSUSE-2019-2206)\");\n script_summary(english:\"Check for the openSUSE-2019-2206 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for mosquitto fixes the following issues :\n\n - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE\n packets that could lead to a stack overflow\n (bsc#1151494).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1151494\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mosquitto packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libmosquitto1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libmosquitto1-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libmosquittopp1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libmosquittopp1-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mosquitto-clients\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mosquitto-clients-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mosquitto-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mosquitto-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mosquitto-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libmosquitto1-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libmosquitto1-debuginfo-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libmosquittopp1-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libmosquittopp1-debuginfo-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"mosquitto-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"mosquitto-clients-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"mosquitto-clients-debuginfo-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"mosquitto-debuginfo-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"mosquitto-debugsource-1.5.7-lp151.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"mosquitto-devel-1.5.7-lp151.2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libmosquitto1 / libmosquitto1-debuginfo / libmosquittopp1 / etc\");\n}\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-10-16T00:22:46", "description": "A vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker, allowing a malicious MQTT client to cause a denial of service (stack overflow and daemon crash), by sending a specially crafted SUBSCRIBE packet containing a topic with a extremely deep hierarchy.", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-11-18T00:00:00", "type": "nessus", "title": "Debian DSA-4570-1 : mosquitto - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-12-09T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:mosquitto", "cpe:/o:debian:debian_linux:10.0"], "id": "DEBIAN_DSA-4570.NASL", "href": "https://www.tenable.com/plugins/nessus/131087", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4570. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(131087);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/12/09\");\n\n script_cve_id(\"CVE-2019-11779\");\n script_xref(name:\"DSA\", value:\"4570\");\n\n script_name(english:\"Debian DSA-4570-1 : mosquitto - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1\ncompatible message broker, allowing a malicious MQTT client to cause a\ndenial of service (stack overflow and daemon crash), by sending a\nspecially crafted SUBSCRIBE packet containing a topic with a extremely\ndeep hierarchy.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940654\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/mosquitto\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/buster/mosquitto\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2019/dsa-4570\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the mosquitto packages.\n\nFor the stable distribution (buster), this problem has been fixed in\nversion 1.5.7-1+deb10u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:10.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/11/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"10.0\", prefix:\"libmosquitto-dev\", reference:\"1.5.7-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libmosquitto1\", reference:\"1.5.7-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libmosquittopp-dev\", reference:\"1.5.7-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libmosquittopp1\", reference:\"1.5.7-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"mosquitto\", reference:\"1.5.7-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"mosquitto-clients\", reference:\"1.5.7-1+deb10u1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"mosquitto-dev\", reference:\"1.5.7-1+deb10u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-10-16T00:24:44", "description": "1.6.7 =====\n\nBroker :\n\n - Add workaround for working with libwebsockets 3.2.0.\n\n - Fix potential crash when reloading config.\n\nClient library :\n\n - Don't use / in autogenerated client ids, to avoid confusing with topics.\n\n - Fix mosquitto_max_inflight_messages_set() and mosquitto_int_option(..., MOSQ_OPT_*_MAX, ...) behaviour.\n\n - Fix regression on use of mosquitto_connect_async() not working.\n\nClients :\n\n - mosquitto_sub: Fix -E incorrectly not working unless -d was also specified.\n\n - Updated documentation around automatic client ids.\n\n1.6.6 =====\n\nSecurity :\n\n - CVE-2019-11779\n\n - Restrict topic hierarchy to 200 levels to prevent possible stack overflow.\n\nBroker :\n\n - Restrict topic hierarchy to 200 levels to prevent possible stack overflow.\n\n - mosquitto_passwd now returns 1 when attempting to update a user that does not exist.\n\n1.6.5 =====\n\nBroker :\n\n - Fix v5 DISCONNECT packets with remaining length == 2 being treated as a protocol error.\n\n - Fix support for libwebsockets 3.x.\n\n - Fix slow websockets performance when sending large messages.\n\n - Fix bridges potentially not connecting on Windows.\n\n - Fix clients authorised using `use_identity_as_username` or `use_subject_as_username` being disconnected on SIGHUP.\n\n - Improve error messages in some situations when clients disconnect. Reduces the number of 'Socket error on client X, disconnecting' messages.\n\n - Fix Will for v5 clients not being sent if will delay interval was greater than the session expiry interval.\n\n - Fix CRL file not being reloaded on HUP.\n\n - Fix repeated 'Error in poll' messages on Windows when only websockets listeners are defined.\n\nClient library :\n\n - Fix reconnect backoff for the situation where connections are dropped rather than refused.\n\n - Fix missing locks on `mosq->state`.\n\nDocumentation :\n\n - Improve details on global/per listener options in the mosquitto.conf man page.\n\n - Clarify behaviour when clients exceed the `message_size_limit`.\n\n - Improve documentation for `max_inflight_bytes`, `max_inflight_messages`, and `max_queued_messages`.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-10-07T00:00:00", "type": "nessus", "title": "Fedora 29 : mosquitto (2019-d99e2329cb)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-12-19T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:mosquitto", "cpe:/o:fedoraproject:fedora:29"], "id": "FEDORA_2019-D99E2329CB.NASL", "href": "https://www.tenable.com/plugins/nessus/129652", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-d99e2329cb.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129652);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/12/19\");\n\n script_cve_id(\"CVE-2019-11779\");\n script_xref(name:\"FEDORA\", value:\"2019-d99e2329cb\");\n\n script_name(english:\"Fedora 29 : mosquitto (2019-d99e2329cb)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"1.6.7 =====\n\nBroker :\n\n - Add workaround for working with libwebsockets 3.2.0.\n\n - Fix potential crash when reloading config.\n\nClient library :\n\n - Don't use / in autogenerated client ids, to avoid\n confusing with topics.\n\n - Fix mosquitto_max_inflight_messages_set() and\n mosquitto_int_option(..., MOSQ_OPT_*_MAX, ...)\n behaviour.\n\n - Fix regression on use of mosquitto_connect_async() not\n working.\n\nClients :\n\n - mosquitto_sub: Fix -E incorrectly not working unless -d\n was also specified.\n\n - Updated documentation around automatic client ids.\n\n1.6.6 =====\n\nSecurity :\n\n - CVE-2019-11779\n\n - Restrict topic hierarchy to 200 levels to prevent\n possible stack overflow.\n\nBroker :\n\n - Restrict topic hierarchy to 200 levels to prevent\n possible stack overflow.\n\n - mosquitto_passwd now returns 1 when attempting to update\n a user that does not exist.\n\n1.6.5 =====\n\nBroker :\n\n - Fix v5 DISCONNECT packets with remaining length == 2\n being treated as a protocol error.\n\n - Fix support for libwebsockets 3.x.\n\n - Fix slow websockets performance when sending large\n messages.\n\n - Fix bridges potentially not connecting on Windows.\n\n - Fix clients authorised using `use_identity_as_username`\n or `use_subject_as_username` being disconnected on\n SIGHUP.\n\n - Improve error messages in some situations when clients\n disconnect. Reduces the number of 'Socket error on\n client X, disconnecting' messages.\n\n - Fix Will for v5 clients not being sent if will delay\n interval was greater than the session expiry interval.\n\n - Fix CRL file not being reloaded on HUP.\n\n - Fix repeated 'Error in poll' messages on Windows when\n only websockets listeners are defined.\n\nClient library :\n\n - Fix reconnect backoff for the situation where\n connections are dropped rather than refused.\n\n - Fix missing locks on `mosq->state`.\n\nDocumentation :\n\n - Improve details on global/per listener options in the\n mosquitto.conf man page.\n\n - Clarify behaviour when clients exceed the\n `message_size_limit`.\n\n - Improve documentation for `max_inflight_bytes`,\n `max_inflight_messages`, and `max_queued_messages`.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-d99e2329cb\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mosquitto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:29\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/07\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^29([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 29\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC29\", reference:\"mosquitto-1.6.7-1.fc29\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mosquitto\");\n}\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-10-16T12:40:20", "description": "1.6.7 =====\n\nBroker :\n\n - Add workaround for working with libwebsockets 3.2.0.\n\n - Fix potential crash when reloading config.\n\nClient library :\n\n - Don't use / in autogenerated client ids, to avoid confusing with topics.\n\n - Fix mosquitto_max_inflight_messages_set() and mosquitto_int_option(..., MOSQ_OPT_*_MAX, ...) behaviour.\n\n - Fix regression on use of mosquitto_connect_async() not working.\n\nClients :\n\n - mosquitto_sub: Fix -E incorrectly not working unless -d was also specified.\n\n - Updated documentation around automatic client ids.\n\n1.6.6 =====\n\nSecurity :\n\n - CVE-2019-11779\n\n - Restrict topic hierarchy to 200 levels to prevent possible stack overflow.\n\nBroker :\n\n - Restrict topic hierarchy to 200 levels to prevent possible stack overflow.\n\n - mosquitto_passwd now returns 1 when attempting to update a user that does not exist.\n\n1.6.5 =====\n\nBroker :\n\n - Fix v5 DISCONNECT packets with remaining length == 2 being treated as a protocol error.\n\n - Fix support for libwebsockets 3.x.\n\n - Fix slow websockets performance when sending large messages.\n\n - Fix bridges potentially not connecting on Windows.\n\n - Fix clients authorised using `use_identity_as_username` or `use_subject_as_username` being disconnected on SIGHUP.\n\n - Improve error messages in some situations when clients disconnect. Reduces the number of 'Socket error on client X, disconnecting' messages.\n\n - Fix Will for v5 clients not being sent if will delay interval was greater than the session expiry interval.\n\n - Fix CRL file not being reloaded on HUP.\n\n - Fix repeated 'Error in poll' messages on Windows when only websockets listeners are defined.\n\nClient library :\n\n - Fix reconnect backoff for the situation where connections are dropped rather than refused.\n\n - Fix missing locks on `mosq->state`.\n\nDocumentation :\n\n - Improve details on global/per listener options in the mosquitto.conf man page.\n\n - Clarify behaviour when clients exceed the `message_size_limit`.\n\n - Improve documentation for `max_inflight_bytes`, `max_inflight_messages`, and `max_queued_messages`.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-10-07T00:00:00", "type": "nessus", "title": "Fedora 30 : mosquitto (2019-8b83c261dd)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-12-20T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:mosquitto", "cpe:/o:fedoraproject:fedora:30"], "id": "FEDORA_2019-8B83C261DD.NASL", "href": "https://www.tenable.com/plugins/nessus/129633", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-8b83c261dd.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129633);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/12/20\");\n\n script_cve_id(\"CVE-2019-11779\");\n script_xref(name:\"FEDORA\", value:\"2019-8b83c261dd\");\n\n script_name(english:\"Fedora 30 : mosquitto (2019-8b83c261dd)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"1.6.7 =====\n\nBroker :\n\n - Add workaround for working with libwebsockets 3.2.0.\n\n - Fix potential crash when reloading config.\n\nClient library :\n\n - Don't use / in autogenerated client ids, to avoid\n confusing with topics.\n\n - Fix mosquitto_max_inflight_messages_set() and\n mosquitto_int_option(..., MOSQ_OPT_*_MAX, ...)\n behaviour.\n\n - Fix regression on use of mosquitto_connect_async() not\n working.\n\nClients :\n\n - mosquitto_sub: Fix -E incorrectly not working unless -d\n was also specified.\n\n - Updated documentation around automatic client ids.\n\n1.6.6 =====\n\nSecurity :\n\n - CVE-2019-11779\n\n - Restrict topic hierarchy to 200 levels to prevent\n possible stack overflow.\n\nBroker :\n\n - Restrict topic hierarchy to 200 levels to prevent\n possible stack overflow.\n\n - mosquitto_passwd now returns 1 when attempting to update\n a user that does not exist.\n\n1.6.5 =====\n\nBroker :\n\n - Fix v5 DISCONNECT packets with remaining length == 2\n being treated as a protocol error.\n\n - Fix support for libwebsockets 3.x.\n\n - Fix slow websockets performance when sending large\n messages.\n\n - Fix bridges potentially not connecting on Windows.\n\n - Fix clients authorised using `use_identity_as_username`\n or `use_subject_as_username` being disconnected on\n SIGHUP.\n\n - Improve error messages in some situations when clients\n disconnect. Reduces the number of 'Socket error on\n client X, disconnecting' messages.\n\n - Fix Will for v5 clients not being sent if will delay\n interval was greater than the session expiry interval.\n\n - Fix CRL file not being reloaded on HUP.\n\n - Fix repeated 'Error in poll' messages on Windows when\n only websockets listeners are defined.\n\nClient library :\n\n - Fix reconnect backoff for the situation where\n connections are dropped rather than refused.\n\n - Fix missing locks on `mosq->state`.\n\nDocumentation :\n\n - Improve details on global/per listener options in the\n mosquitto.conf man page.\n\n - Clarify behaviour when clients exceed the\n `message_size_limit`.\n\n - Improve documentation for `max_inflight_bytes`,\n `max_inflight_messages`, and `max_queued_messages`.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-8b83c261dd\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mosquitto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:30\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/07\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^30([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 30\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC30\", reference:\"mosquitto-1.6.7-1.fc30\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mosquitto\");\n}\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-10-16T00:24:16", "description": "1.6.7 =====\n\nBroker :\n\n - Add workaround for working with libwebsockets 3.2.0.\n\n - Fix potential crash when reloading config.\n\nClient library :\n\n - Don't use / in autogenerated client ids, to avoid confusing with topics.\n\n - Fix mosquitto_max_inflight_messages_set() and mosquitto_int_option(..., MOSQ_OPT_*_MAX, ...) behaviour.\n\n - Fix regression on use of mosquitto_connect_async() not working.\n\nClients :\n\n - mosquitto_sub: Fix -E incorrectly not working unless -d was also specified.\n\n - Updated documentation around automatic client ids.\n\n1.6.6 =====\n\nSecurity :\n\n - CVE-2019-11779\n\n - Restrict topic hierarchy to 200 levels to prevent possible stack overflow.\n\nBroker :\n\n - Restrict topic hierarchy to 200 levels to prevent possible stack overflow.\n\n - mosquitto_passwd now returns 1 when attempting to update a user that does not exist.\n\n1.6.5 =====\n\nBroker :\n\n - Fix v5 DISCONNECT packets with remaining length == 2 being treated as a protocol error.\n\n - Fix support for libwebsockets 3.x.\n\n - Fix slow websockets performance when sending large messages.\n\n - Fix bridges potentially not connecting on Windows.\n\n - Fix clients authorised using `use_identity_as_username` or `use_subject_as_username` being disconnected on SIGHUP.\n\n - Improve error messages in some situations when clients disconnect. Reduces the number of 'Socket error on client X, disconnecting' messages.\n\n - Fix Will for v5 clients not being sent if will delay interval was greater than the session expiry interval.\n\n - Fix CRL file not being reloaded on HUP.\n\n - Fix repeated 'Error in poll' messages on Windows when only websockets listeners are defined.\n\nClient library :\n\n - Fix reconnect backoff for the situation where connections are dropped rather than refused.\n\n - Fix missing locks on `mosq->state`.\n\nDocumentation :\n\n - Improve details on global/per listener options in the mosquitto.conf man page.\n\n - Clarify behaviour when clients exceed the `message_size_limit`.\n\n - Improve documentation for `max_inflight_bytes`, `max_inflight_messages`, and `max_queued_messages`.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-10-07T00:00:00", "type": "nessus", "title": "Fedora 31 : mosquitto (2019-4c69fb4cd7)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-12-20T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:mosquitto", "cpe:/o:fedoraproject:fedora:31"], "id": "FEDORA_2019-4C69FB4CD7.NASL", "href": "https://www.tenable.com/plugins/nessus/129616", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-4c69fb4cd7.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129616);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/12/20\");\n\n script_cve_id(\"CVE-2019-11779\");\n script_xref(name:\"FEDORA\", value:\"2019-4c69fb4cd7\");\n\n script_name(english:\"Fedora 31 : mosquitto (2019-4c69fb4cd7)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"1.6.7 =====\n\nBroker :\n\n - Add workaround for working with libwebsockets 3.2.0.\n\n - Fix potential crash when reloading config.\n\nClient library :\n\n - Don't use / in autogenerated client ids, to avoid\n confusing with topics.\n\n - Fix mosquitto_max_inflight_messages_set() and\n mosquitto_int_option(..., MOSQ_OPT_*_MAX, ...)\n behaviour.\n\n - Fix regression on use of mosquitto_connect_async() not\n working.\n\nClients :\n\n - mosquitto_sub: Fix -E incorrectly not working unless -d\n was also specified.\n\n - Updated documentation around automatic client ids.\n\n1.6.6 =====\n\nSecurity :\n\n - CVE-2019-11779\n\n - Restrict topic hierarchy to 200 levels to prevent\n possible stack overflow.\n\nBroker :\n\n - Restrict topic hierarchy to 200 levels to prevent\n possible stack overflow.\n\n - mosquitto_passwd now returns 1 when attempting to update\n a user that does not exist.\n\n1.6.5 =====\n\nBroker :\n\n - Fix v5 DISCONNECT packets with remaining length == 2\n being treated as a protocol error.\n\n - Fix support for libwebsockets 3.x.\n\n - Fix slow websockets performance when sending large\n messages.\n\n - Fix bridges potentially not connecting on Windows.\n\n - Fix clients authorised using `use_identity_as_username`\n or `use_subject_as_username` being disconnected on\n SIGHUP.\n\n - Improve error messages in some situations when clients\n disconnect. Reduces the number of 'Socket error on\n client X, disconnecting' messages.\n\n - Fix Will for v5 clients not being sent if will delay\n interval was greater than the session expiry interval.\n\n - Fix CRL file not being reloaded on HUP.\n\n - Fix repeated 'Error in poll' messages on Windows when\n only websockets listeners are defined.\n\nClient library :\n\n - Fix reconnect backoff for the situation where\n connections are dropped rather than refused.\n\n - Fix missing locks on `mosq->state`.\n\nDocumentation :\n\n - Improve details on global/per listener options in the\n mosquitto.conf man page.\n\n - Clarify behaviour when clients exceed the\n `message_size_limit`.\n\n - Improve documentation for `max_inflight_bytes`,\n `max_inflight_messages`, and `max_queued_messages`.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-4c69fb4cd7\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mosquitto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:31\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/07\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^31([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 31\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC31\", reference:\"mosquitto-1.6.7-1.fc31\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mosquitto\");\n}\n", "cvss": {"score": 4, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:19:08", "description": "Several issues have been found in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker.\n\nCVE-2017-7655\n\nA Null dereference vulnerability in the Mosquitto library could lead to crashes for those applications using the library.\n\nCVE-2018-12550\n\nAn ACL file with no statements was treated as having a default allow policy. The new behaviour of an empty ACL file is a default policy of access denied. (this is in compliance with all newer releases)\n\nCVE-2018-12551\n\nMalformed authentication data in the password file could allow clients to circumvent authentication and get access to the broker.\n\nCVE-2019-11779\n\nFix for processing a crafted SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters. (setting TOPIC_HIERARCHY_LIMIT to 200)\n\nFor Debian 8 'Jessie', these problems have been fixed in version 1.3.4-2+deb8u4.\n\nWe recommend that you upgrade your mosquitto packages.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 8.1, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-10-28T00:00:00", "type": "nessus", "title": "Debian DLA-1972-1 : mosquitto security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-7655", "CVE-2018-12550", "CVE-2018-12551", "CVE-2019-11779"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libmosquitto-dev", "p-cpe:/a:debian:debian_linux:libmosquitto1", "p-cpe:/a:debian:debian_linux:libmosquittopp-dev", "p-cpe:/a:debian:debian_linux:libmosquittopp1", "p-cpe:/a:debian:debian_linux:mosquitto", "p-cpe:/a:debian:debian_linux:mosquitto-clients", "p-cpe:/a:debian:debian_linux:mosquitto-dbg", "p-cpe:/a:debian:debian_linux:python-mosquitto", "p-cpe:/a:debian:debian_linux:python3-mosquitto", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DLA-1972.NASL", "href": "https://www.tenable.com/plugins/nessus/130285", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-1972-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(130285);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2017-7655\", \"CVE-2018-12550\", \"CVE-2018-12551\", \"CVE-2019-11779\");\n\n script_name(english:\"Debian DLA-1972-1 : mosquitto security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several issues have been found in mosquitto, a MQTT version 3.1/3.1.1\ncompatible message broker.\n\nCVE-2017-7655\n\nA Null dereference vulnerability in the Mosquitto library could lead\nto crashes for those applications using the library.\n\nCVE-2018-12550\n\nAn ACL file with no statements was treated as having a default allow\npolicy. The new behaviour of an empty ACL file is a default policy of\naccess denied. (this is in compliance with all newer releases)\n\nCVE-2018-12551\n\nMalformed authentication data in the password file could allow clients\nto circumvent authentication and get access to the broker.\n\nCVE-2019-11779\n\nFix for processing a crafted SUBSCRIBE packet containing a topic that\nconsists of approximately 65400 or more '/' characters. (setting\nTOPIC_HIERARCHY_LIMIT to 200)\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n1.3.4-2+deb8u4.\n\nWe recommend that you upgrade your mosquitto packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/mosquitto\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libmosquitto-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libmosquitto1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libmosquittopp-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libmosquittopp1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mosquitto-clients\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mosquitto-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:python-mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:python3-mosquitto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/03/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"libmosquitto-dev\", reference:\"1.3.4-2+deb8u4\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libmosquitto1\", reference:\"1.3.4-2+deb8u4\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libmosquittopp-dev\", reference:\"1.3.4-2+deb8u4\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libmosquittopp1\", reference:\"1.3.4-2+deb8u4\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"mosquitto\", reference:\"1.3.4-2+deb8u4\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"mosquitto-clients\", reference:\"1.3.4-2+deb8u4\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"mosquitto-dbg\", reference:\"1.3.4-2+deb8u4\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"python-mosquitto\", reference:\"1.3.4-2+deb8u4\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"python3-mosquitto\", reference:\"1.3.4-2+deb8u4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2019-10-11T18:36:21", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-10-05T00:00:00", "type": "openvas", "title": "Fedora Update for mosquitto FEDORA-2019-d99e2329cb", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-10-11T00:00:00", "id": "OPENVAS:1361412562310876881", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310876881", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.876881\");\n script_version(\"2019-10-11T07:39:42+0000\");\n script_cve_id(\"CVE-2019-11779\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-10-11 07:39:42 +0000 (Fri, 11 Oct 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-10-05 02:31:34 +0000 (Sat, 05 Oct 2019)\");\n script_name(\"Fedora Update for mosquitto FEDORA-2019-d99e2329cb\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-d99e2329cb\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'mosquitto'\n package(s) announced via the FEDORA-2019-d99e2329cb advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Mosquitto is an open source message broker that implements the MQ Telemetry\nTransport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method\nof carrying out messaging using a publish/subscribe model. This makes it\nsuitable for 'machine to machine' messaging such as with low power sensors\nor mobile devices such as phones, embedded computers or micro-controllers\nlike the Arduino.\");\n\n script_tag(name:\"affected\", value:\"'mosquitto' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto\", rpm:\"mosquitto~1.6.7~1.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2020-01-31T16:30:12", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2020-01-09T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for mosquitto (openSUSE-SU-2019:2206-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310852812", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852812", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852812\");\n script_version(\"2020-01-31T08:04:39+0000\");\n script_cve_id(\"CVE-2019-11779\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:04:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-09 09:33:09 +0000 (Thu, 09 Jan 2020)\");\n script_name(\"openSUSE: Security Advisory for mosquitto (openSUSE-SU-2019:2206-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.1\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2019:2206-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00077.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'mosquitto'\n package(s) announced via the openSUSE-SU-2019:2206-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for mosquitto fixes the following issues:\n\n - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that\n could lead to a stack overflow (bsc#1151494).\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.1:\n\n zypper in -t patch openSUSE-2019-2206=1\");\n\n script_tag(name:\"affected\", value:\"'mosquitto' package(s) on openSUSE Leap 15.1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libmosquitto1\", rpm:\"libmosquitto1~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libmosquitto1-debuginfo\", rpm:\"libmosquitto1-debuginfo~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libmosquittopp1\", rpm:\"libmosquittopp1~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libmosquittopp1-debuginfo\", rpm:\"libmosquittopp1-debuginfo~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto\", rpm:\"mosquitto~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto-clients\", rpm:\"mosquitto-clients~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto-clients-debuginfo\", rpm:\"mosquitto-clients-debuginfo~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto-debuginfo\", rpm:\"mosquitto-debuginfo~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto-debugsource\", rpm:\"mosquitto-debugsource~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto-devel\", rpm:\"mosquitto-devel~1.5.7~lp151.2.3.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2019-09-27T12:42:30", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-09-24T00:00:00", "type": "openvas", "title": "Ubuntu Update for mosquitto USN-4137-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-09-27T00:00:00", "id": "OPENVAS:1361412562310844183", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844183", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844183\");\n script_version(\"2019-09-27T07:41:55+0000\");\n script_cve_id(\"CVE-2019-11779\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-09-27 07:41:55 +0000 (Fri, 27 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-09-24 02:00:46 +0000 (Tue, 24 Sep 2019)\");\n script_name(\"Ubuntu Update for mosquitto USN-4137-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU19\\.04\");\n\n script_xref(name:\"USN\", value:\"4137-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-September/005129.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'mosquitto'\n package(s) announced via the USN-4137-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was discovered that Mosquitto incorrectly handled certain specially crafted\ninput and network packets. A remote attacker could use this to cause a denial\nof service.\");\n\n script_tag(name:\"affected\", value:\"'mosquitto' package(s) on Ubuntu 19.04.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU19.04\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"libmosquitto1\", ver:\"1.5.7-1ubuntu0.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"libmosquittopp1\", ver:\"1.5.7-1ubuntu0.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"mosquitto\", ver:\"1.5.7-1ubuntu0.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"mosquitto-clients\", ver:\"1.5.7-1ubuntu0.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2019-11-20T15:43:54", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-11-19T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 4570-1 (mosquitto - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-11-19T00:00:00", "id": "OPENVAS:1361412562310704570", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704570", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704570\");\n script_version(\"2019-11-19T03:00:16+0000\");\n script_cve_id(\"CVE-2019-11779\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-11-19 03:00:16 +0000 (Tue, 19 Nov 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-11-19 03:00:16 +0000 (Tue, 19 Nov 2019)\");\n script_name(\"Debian Security Advisory DSA 4570-1 (mosquitto - security update)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB10\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2019/dsa-4570.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DSA-4570-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'mosquitto'\n package(s) announced via the DSA-4570-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1\ncompatible message broker, allowing a malicious MQTT client to cause a\ndenial of service (stack overflow and daemon crash), by sending a\nspecially crafted SUBSCRIBE packet containing a topic with a extremely\ndeep hierarchy.\");\n\n script_tag(name:\"affected\", value:\"'mosquitto' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For the stable distribution (buster), this problem has been fixed in\nversion 1.5.7-1+deb10u1.\n\nWe recommend that you upgrade your mosquitto packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"libmosquitto-dev\", ver:\"1.5.7-1+deb10u1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libmosquitto1\", ver:\"1.5.7-1+deb10u1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libmosquittopp-dev\", ver:\"1.5.7-1+deb10u1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libmosquittopp1\", ver:\"1.5.7-1+deb10u1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"mosquitto\", ver:\"1.5.7-1+deb10u1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"mosquitto-clients\", ver:\"1.5.7-1+deb10u1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"mosquitto-dev\", ver:\"1.5.7-1+deb10u1\", rls:\"DEB10\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2019-10-11T18:40:44", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-10-05T00:00:00", "type": "openvas", "title": "Fedora Update for mosquitto FEDORA-2019-8b83c261dd", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2019-10-11T00:00:00", "id": "OPENVAS:1361412562310876880", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310876880", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.876880\");\n script_version(\"2019-10-11T07:39:42+0000\");\n script_cve_id(\"CVE-2019-11779\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-10-11 07:39:42 +0000 (Fri, 11 Oct 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-10-05 02:31:32 +0000 (Sat, 05 Oct 2019)\");\n script_name(\"Fedora Update for mosquitto FEDORA-2019-8b83c261dd\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC30\");\n\n script_xref(name:\"FEDORA\", value:\"2019-8b83c261dd\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'mosquitto'\n package(s) announced via the FEDORA-2019-8b83c261dd advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Mosquitto is an open source message broker that implements the MQ Telemetry\nTransport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method\nof carrying out messaging using a publish/subscribe model. This makes it\nsuitable for 'machine to machine' messaging such as with low power sensors\nor mobile devices such as phones, embedded computers or micro-controllers\nlike the Arduino.\");\n\n script_tag(name:\"affected\", value:\"'mosquitto' package(s) on Fedora 30.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC30\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto\", rpm:\"mosquitto~1.6.7~1.fc30\", rls:\"FC30\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2020-01-14T14:47:34", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2020-01-09T00:00:00", "type": "openvas", "title": "Fedora Update for mosquitto FEDORA-2019-4c69fb4cd7", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11779"], "modified": "2020-01-13T00:00:00", "id": "OPENVAS:1361412562310877257", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310877257", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.877257\");\n script_version(\"2020-01-13T11:49:13+0000\");\n script_cve_id(\"CVE-2019-11779\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-13 11:49:13 +0000 (Mon, 13 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-09 07:34:31 +0000 (Thu, 09 Jan 2020)\");\n script_name(\"Fedora Update for mosquitto FEDORA-2019-4c69fb4cd7\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC31\");\n\n script_xref(name:\"FEDORA\", value:\"2019-4c69fb4cd7\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFWQBNFTAVHPUYNGYO2TCPF5PCSWC2Z7\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'mosquitto'\n package(s) announced via the FEDORA-2019-4c69fb4cd7 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Mosquitto is an open source message broker that implements the MQ Telemetry\nTransport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method\nof carrying out messaging using a publish/subscribe model. This makes it\nsuitable for 'machine to machine' messaging such as with low power sensors\nor mobile devices such as phones, embedded computers or micro-controllers\nlike the Arduino.\");\n\n script_tag(name:\"affected\", value:\"'mosquitto' package(s) on Fedora 31.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC31\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"mosquitto\", rpm:\"mosquitto~1.6.7~1.fc31\", rls:\"FC31\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2020-01-29T19:24:44", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-10-27T00:00:00", "type": "openvas", "title": "Debian LTS: Security Advisory for mosquitto (DLA-1972-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-7655", "CVE-2019-11779", "CVE-2018-12550", "CVE-2018-12551"], "modified": "2020-01-29T00:00:00", "id": "OPENVAS:1361412562310891972", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891972", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891972\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2017-7655\", \"CVE-2018-12550\", \"CVE-2018-12551\", \"CVE-2019-11779\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-27 03:00:13 +0000 (Sun, 27 Oct 2019)\");\n script_name(\"Debian LTS: Security Advisory for mosquitto (DLA-1972-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DLA-1972-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'mosquitto'\n package(s) announced via the DLA-1972-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Several issues have been found in mosquitto, a MQTT version 3.1/3.1.1\ncompatible message broker.\n\nCVE-2017-7655\n\nA Null dereference vulnerability in the Mosquitto library could\nlead to crashes for those applications using the library.\n\nCVE-2018-12550\n\nAn ACL file with no statements was treated as having a default\nallow policy. The new behaviour of an empty ACL file is a default\npolicy of access denied.\n(this is in compliance with all newer releases)\n\nCVE-2018-12551\n\nMalformed authentication data in the password file could allow\nclients to circumvent authentication and get access to the broker.\n\nCVE-2019-11779\n\nFix for processing a crafted SUBSCRIBE packet containing a topic\nthat consists of approximately 65400 or more '/' characters.\n(setting TOPIC_HIERARCHY_LIMIT to 200)\");\n\n script_tag(name:\"affected\", value:\"'mosquitto' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', these problems have been fixed in version\n1.3.4-2+deb8u4.\n\nWe recommend that you upgrade your mosquitto packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"libmosquitto-dev\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libmosquitto1\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libmosquittopp-dev\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libmosquittopp1\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"mosquitto\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"mosquitto-clients\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"mosquitto-dbg\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"python-mosquitto\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"python3-mosquitto\", ver:\"1.3.4-2+deb8u4\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ubuntu": [{"lastseen": "2022-01-04T11:37:08", "description": "It was discovered that Mosquitto incorrectly handled certain specially crafted \ninput and network packets. A remote attacker could use this to cause a denial \nof service.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-09-23T00:00:00", "type": "ubuntu", "title": "Mosquitto vulnerability", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-09-23T00:00:00", "id": "USN-4137-1", "href": "https://ubuntu.com/security/notices/USN-4137-1", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "cve": [{"lastseen": "2022-03-23T19:28:08", "description": "In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-09-19T14:15:00", "type": "cve", "title": "CVE-2019-11779", "cwe": ["CWE-674"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2021-10-28T15:12:00", "cpe": ["cpe:/o:fedoraproject:fedora:29", "cpe:/a:opensuse:backports_sle:15.0", "cpe:/o:fedoraproject:fedora:31", "cpe:/o:opensuse:leap:15.1", "cpe:/o:canonical:ubuntu_linux:19.04", "cpe:/o:debian:debian_linux:10.0", "cpe:/o:debian:debian_linux:8.0", "cpe:/o:fedoraproject:fedora:30"], "id": "CVE-2019-11779", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-11779", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*"]}], "fedora": [{"lastseen": "2021-07-28T14:46:51", "description": "Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for \"machine to machine\" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-10-04T20:07:25", "type": "fedora", "title": "[SECURITY] Fedora 31 Update: mosquitto-1.6.7-1.fc31", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-10-04T20:07:25", "id": "FEDORA:EF6A1633F10B", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HFWQBNFTAVHPUYNGYO2TCPF5PCSWC2Z7/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-07-28T14:46:51", "description": "Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for \"machine to machine\" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-10-04T21:25:08", "type": "fedora", "title": "[SECURITY] Fedora 30 Update: mosquitto-1.6.7-1.fc30", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-10-04T21:25:08", "id": "FEDORA:B767D633F125", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-07-28T14:46:51", "description": "Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for \"machine to machine\" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-10-04T21:57:17", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: mosquitto-1.6.7-1.fc29", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-10-04T21:57:17", "id": "FEDORA:2D772634EB70", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "debiancve": [{"lastseen": "2022-04-20T07:36:11", "description": "In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-09-19T14:15:00", "type": "debiancve", "title": "CVE-2019-11779", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-09-19T14:15:00", "id": "DEBIANCVE:CVE-2019-11779", "href": "https://security-tracker.debian.org/tracker/CVE-2019-11779", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "mageia": [{"lastseen": "2022-04-18T11:19:34", "description": "Updated mosquitto packages fix security vulnerability: A vulnerability was discovered in mosquitto, allowing a malicious MQTT client to cause a denial of service (stack overflow and daemon crash), by sending a specially crafted SUBSCRIBE packet containing a topic with a extremely deep hierarchy (CVE-2019-11779). \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-11-30T13:06:06", "type": "mageia", "title": "Updated mosquitto packages fix security vulnerability\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-11-30T13:06:06", "id": "MGASA-2019-0345", "href": "https://advisories.mageia.org/MGASA-2019-0345.html", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:29:37", "description": "In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client\nsends a SUBSCRIBE packet containing a topic that consists of approximately\n65400 or more '/' characters, i.e. the topic hierarchy separator, then a\nstack overflow will occur.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940654>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-09-19T00:00:00", "type": "ubuntucve", "title": "CVE-2019-11779", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11779"], "modified": "2019-09-19T00:00:00", "id": "UB:CVE-2019-11779", "href": "https://ubuntu.com/security/CVE-2019-11779", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}]}