In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet
    containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy
    separator, then a stack overflow will occur. (CVE-2019-11779)

A vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker, allowing a malicious MQTT client to cause a denial of service (stack overflow and daemon crash), by sending a specially crafted SUBSCRIBE packet containing a topic with a extremely deep hierarchy.

Several issues have been found in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker.

CVE-2017-7655

A Null dereference vulnerability in the Mosquitto library could lead to crashes for those applications using the library.

CVE-2018-12550

An ACL file with no statements was treated as having a default allow policy. The new behaviour of an empty ACL file is a default policy of access denied. (this is in compliance with all newer releases)

CVE-2018-12551

Malformed authentication data in the password file could allow clients to circumvent authentication and get access to the broker.

CVE-2019-11779

Fix for processing a crafted SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters. (setting TOPIC_HIERARCHY_LIMIT to 200)

For Debian 8 'Jessie', these problems have been fixed in version 1.3.4-2+deb8u4.

We recommend that you upgrade your mosquitto packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

1.6.7 =====

Broker :

  - Add workaround for working with libwebsockets 3.2.0.

  - Fix potential crash when reloading config.

Client library :

  - Don't use / in autogenerated client ids, to avoid     confusing with topics.

  - Fix mosquitto_max_inflight_messages_set() and     mosquitto_int_option(..., MOSQ_OPT_*_MAX, ...)     behaviour.

  - Fix regression on use of mosquitto_connect_async() not     working.

Clients :

  - mosquitto_sub: Fix -E incorrectly not working unless -d     was also specified.

  - Updated documentation around automatic client ids.

1.6.6 =====

Security :

  - CVE-2019-11779

  - Restrict topic hierarchy to 200 levels to prevent     possible stack overflow.

Broker :

  - Restrict topic hierarchy to 200 levels to prevent     possible stack overflow.

  - mosquitto_passwd now returns 1 when attempting to update     a user that does not exist.

1.6.5 =====

Broker :

  - Fix v5 DISCONNECT packets with remaining length == 2     being treated as a protocol error.

  - Fix support for libwebsockets 3.x.

  - Fix slow websockets performance when sending large     messages.

  - Fix bridges potentially not connecting on Windows.

  - Fix clients authorised using `use_identity_as_username`     or `use_subject_as_username` being disconnected on     SIGHUP.

  - Improve error messages in some situations when clients     disconnect. Reduces the number of 'Socket error on     client X, disconnecting' messages.

  - Fix Will for v5 clients not being sent if will delay     interval was greater than the session expiry interval.

  - Fix CRL file not being reloaded on HUP.

  - Fix repeated 'Error in poll' messages on Windows when     only websockets listeners are defined.

Client library :

  - Fix reconnect backoff for the situation where     connections are dropped rather than refused.

  - Fix missing locks on `mosq->state`.

Documentation :

  - Improve details on global/per listener options in the     mosquitto.conf man page.

  - Clarify behaviour when clients exceed the     `message_size_limit`.

  - Improve documentation for `max_inflight_bytes`,     `max_inflight_messages`, and `max_queued_messages`.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mosquitto fixes the following issues :

  - CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE     packets that could lead to a stack overflow     (bsc#1151494).

It was discovered that Mosquitto incorrectly handled certain specially crafted input and network packets. A remote attacker could use this to cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
424180	Alpine: multiple mosquitto packages: security update to 1.6.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424180	Alpine: multiple mosquitto packages: security update to 1.6.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
405607	Alpine: mosquitto: security update to 1.6.3-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405607	Alpine: mosquitto: security update to 1.6.3-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
405605	Alpine: mosquitto: security update to 1.5.6-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405605	Alpine: mosquitto: security update to 1.5.6-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400446	Alpine: multiple mosquitto packages: security update to 1.6.4-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400446	Alpine: multiple mosquitto packages: security update to 1.6.4-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
131087	Debian DSA-4570-1 : mosquitto - security update	Nessus	Debian Local Security Checks	medium
130285	Debian DLA-1972-1 : mosquitto security update	Nessus	Debian Local Security Checks	high
129652	Fedora 29 : mosquitto (2019-d99e2329cb)	Nessus	Fedora Local Security Checks	medium
129633	Fedora 30 : mosquitto (2019-8b83c261dd)	Nessus	Fedora Local Security Checks	medium
129616	Fedora 31 : mosquitto (2019-4c69fb4cd7)	Nessus	Fedora Local Security Checks	medium
129458	openSUSE Security Update : mosquitto (openSUSE-2019-2206)	Nessus	SuSE Local Security Checks	medium
129290	Ubuntu 19.04 : Mosquitto vulnerability (USN-4137-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2019-11779

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium