[Debian-iot-maintainers] Bug#1084982: mosquitto: CVE-2024-8376

[Moritz Mühlenhoff]

Source: mosquitto
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for mosquitto.

CVE-2024-8376[0]:
| In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve
| memory leaking, segmentation fault or heap-use-after-free by sending
| specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE",
| "UNSUBSCRIBE" and "PUBLISH" packets.

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/218
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/227
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/217
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/216
https://gitlab.eclipse.org/security/cve-assignement/-/issues/26


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-8376
    https://www.cve.org/CVERecord?id=CVE-2024-8376

Please adjust the affected versions in the BTS as needed.