Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f7985d4d by Salvatore Bonaccorso at 2019-11-17T15:56:49Z
Give more detailed explanation on CVE-2019-11779/mosquitto
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -24097,6 +24097,10 @@ CVE-2019-11779 (In Eclipse Mosquitto 1.5.0 to 1.6.5
inclusive, if a malicious MQ
NOTE: Fixed by:
https://github.com/eclipse/mosquitto/commit/106675093177335b18521bc0e5ad1d95343ad652
(1.6.6)
NOTE: Fixed by:
https://github.com/eclipse/mosquitto/commit/84681d9728ceb7f6ea2b6751b4d87200d8a62f14
(1.5.9)
NOTE: https://mosquitto.org/blog/2019/09/version-1-6-6-released/
+ NOTE: The issue manifests in versions 1.5.0 and onwards only, because
some structs
+ NOTE: increased in size enough to cause the stack overflow
vulnerability for excessive
+ NOTE: topic hierarchies. In earlier versions, the maximum possible
hierarchy depth of
+ NOTE: 65535 wouldn't cause a stack overflow.
CVE-2019-11778 (If an MQTT v5 client connects to Eclipse Mosquitto versions
1.6.0 to 1 ...)
- mosquitto 1.6.6-1
[buster] - mosquitto <not-affected> (Session expiry interval support
introduced in 1.6)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f7985d4db7aeaf5880ad2d21c046cdf8833adcdb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f7985d4db7aeaf5880ad2d21c046cdf8833adcdb
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
