========================================================================== Ubuntu Security Notice USN-7441-1 April 16, 2025
mosquitto vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Eclipse Mosquitto.
Software Description:
- mosquitto: MQTT compatible message broker
Details:
It was discovered that Eclipse Mosquitto client incorrectly handled
memory when receiving a SUBACK packet. An attacker with a malicious
broker could possibly use this issue to execute arbitrary code or
cause a denial of service. (CVE-2024-10525)
Xiangpu Song discovered that Eclipse Mosquitto broker did not properly
manage memory under certain circumstances. A malicious client with a
remote connection could possibly use this issue to cause the broker to
crash resulting in a denial of service, or another unspecified impact.
This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-3935)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
libmosquitto1 2.0.18-1ubuntu0.1~esm1
Available with Ubuntu Pro
libmosquittopp1 2.0.18-1ubuntu0.1~esm1
Available with Ubuntu Pro
mosquitto 2.0.18-1ubuntu0.1~esm1
Available with Ubuntu Pro
mosquitto-clients 2.0.18-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
libmosquitto1 2.0.11-1ubuntu1.2
libmosquittopp1 2.0.11-1ubuntu1.2
mosquitto 2.0.11-1ubuntu1.2
mosquitto-clients 2.0.11-1ubuntu1.2
Ubuntu 20.04 LTS
libmosquitto1 1.6.9-1ubuntu0.1~esm2
Available with Ubuntu Pro
libmosquittopp1 1.6.9-1ubuntu0.1~esm2
Available with Ubuntu Pro
mosquitto 1.6.9-1ubuntu0.1~esm2
Available with Ubuntu Pro
mosquitto-clients 1.6.9-1ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 18.04 LTS
libmosquitto1 1.4.15-2ubuntu0.18.04.3+esm2
Available with Ubuntu Pro
libmosquittopp1 1.4.15-2ubuntu0.18.04.3+esm2
Available with Ubuntu Pro
mosquitto 1.4.15-2ubuntu0.18.04.3+esm2
Available with Ubuntu Pro
mosquitto-clients 1.4.15-2ubuntu0.18.04.3+esm2
Available with Ubuntu Pro
Ubuntu 16.04 LTS
libmosquitto1 1.4.8-1ubuntu0.16.04.7+esm2
Available with Ubuntu Pro
libmosquittopp1 1.4.8-1ubuntu0.16.04.7+esm2
Available with Ubuntu Pro
mosquitto 1.4.8-1ubuntu0.16.04.7+esm2
Available with Ubuntu Pro
mosquitto-clients 1.4.8-1ubuntu0.16.04.7+esm2
Available with Ubuntu Pro
Ubuntu 14.04 LTS
libmosquitto0 0.15-2+deb7u3ubuntu0.1+esm1
Available with Ubuntu Pro
libmosquittopp0 0.15-2+deb7u3ubuntu0.1+esm1
Available with Ubuntu Pro
mosquitto 0.15-2+deb7u3ubuntu0.1+esm1
Available with Ubuntu Pro
mosquitto-clients 0.15-2+deb7u3ubuntu0.1+esm1
Available with Ubuntu Pro
python-mosquitto 0.15-2+deb7u3ubuntu0.1+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7441-1
CVE-2024-10525, CVE-2024-3935
Package Information:
https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1ubuntu1.2
OpenPGP_signature.asc
Description: OpenPGP digital signature
