666 matches found
CVE-2018-12550
CVE-2018-12550 affects Eclipse Mosquitto 1.0–1.5.5 when an ACL file is configured but empty or only comments/blank lines, causing the broker to treat the file as defined and switch from a default deny to a default allow policy. Public disclosures in connected docs confirm the vulnerability behavi...
CVE-2018-12546
In Eclipse Mosquitto version 1.0 to 1.5.5 inclusive when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients...
CVE-2018-12550
When Eclipse Mosquitto version 1.0 to 1.5.5 inclusive is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty...
CVE-2018-12551
When Eclipse Mosquitto version 1.0 to 1.5.5 inclusive is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent...
OPENSUSE-SU-2019:0233-1 Security update for mosquitto
This update for mosquitto fixes the following issues: Security issues fixed: - CVE-2018-12546: Fixed an issue with revoked access to topics bsc1125019. - CVE-2018-12551: Fixed an issue which allowed malformed data in the password file to be treated as valid bsc1125020. - CVE-2018-12550: Fixed an ...
openSUSE Security Update : mosquitto (openSUSE-2019-233)
This update for mosquitto fixes the following issues : Security issues fixed : - CVE-2018-12546: Fixed an issue with revoked access to topics bsc1125019. - CVE-2018-12551: Fixed an issue which allowed malformed data in the password file to be treated as valid bsc1125020. - CVE-2018-12550: Fixed a...
OPENSUSE-SU-2019:0237-1 Security update for mosquitto
This update for mosquitto fixes the following issues: Security issues fixed: - CVE-2018-12546: Fixed an issue with revoked access to topics bsc1125019. - CVE-2018-12551: Fixed an issue which allowed malformed data in the password file to be treated as valid bsc1125020. - CVE-2018-12550: Fixed an ...
Security update for mosquitto (low)
openSUSE Security Update: Security update for mosquitto Announcement ID: openSUSE-SU-2019:0237-1 Rating: low References: 1125019 1125020 1125021 Cross-References: CVE-2018-12546 CVE-2018-12550 CVE-2018-12551 Affected Products: openSUSE Backports SLE-15 An update that fixes three vulnerabilities i...
openSUSE: Security Advisory for mosquitto (openSUSE-SU-2019:0233-1)
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Security update for mosquitto (low)
openSUSE Security Update: Security update for mosquitto Announcement ID: openSUSE-SU-2019:0233-1 Rating: low References: 1125019 1125020 1125021 Cross-References: CVE-2018-12546 CVE-2018-12550 CVE-2018-12551 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilities is now...
Fedora 28 : mosquitto (2019-8cbe2a05cd)
Fixes for the following CVES : - CVE-2018-12546 - CVE-2018-12550 - CVE-2018-12551 The list of other fixes addressed in version 1.5.6 is: Broker : - Fixed comment handling for config options that have optional arguments. - Improved documentation around bridge topic remapping. - Handle mismatched...
[SECURITY] Fedora 28 Update: mosquitto-1.5.6-1.fc28
Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...
Fedora Update for mosquitto FEDORA-2019-8cbe2a05cd
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] [DSA 4388-2] mosquitto regression update
------------------------------------------------------------------------- Debian Security Advisory DSA-4388-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 17, 2019 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4388-2] mosquitto regression update
------------------------------------------------------------------------- Debian Security Advisory DSA-4388-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 17, 2019 https://www.debian.org/security/faq -...
DSA-4388-2 mosquitto - regression update
Bulletin has no description...
Authentication Bypass
Mosquitto is vulnerable to authentication bypass due to incorrect data validation. Clients are granted access to the broker because it incorrectly validated empty lines or malformed data in the password file, treating such data as a valid username and allowing an attacker to bypass authentication...
Missing Access Control Enforcement
Mosquitto is vulnerable to missing access control enforcement. The library does not enforce the access control checking for retained messages published by an authorized user to not to deliver to future subscriber after the publisher's access has been revoked for that topic...
[SECURITY] [DSA 4388-1] mosquitto security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4388-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 10, 2019 https://www.debian.org/security/faq -...