In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit.

Release 1.5.3

Security :

  - Fix CVE-2018-12543. If a message is sent to Mosquitto     with a topic that begins with $, but is not $SYS, then     an assert that should be unreachable is triggered and     Mosquitto will exit.

Broker :

  - Elevate log level to warning for situation when socket     limit is hit.

  - Remove requirement to use `user root` in snap package     config files.

  - Fix retained messages not sent by bridges on outgoing     topics at the first connection.

  - Documentation fixes.

  - Fix duplicate clients being added to by_id hash before     the old client was removed.

  - Fix Windows version not starting if include_dir did not     contain any files.

Build :

  - Various fixes to ease building.

----

Use WITH_BUNDLED_DEPS=no

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
120940	Fedora 29 : mosquitto (2018-ff1fdf28aa)	Nessus	Fedora Local Security Checks	high
120649	Fedora 28 : mosquitto (2018-9a6af7815a)	Nessus	Fedora Local Security Checks	high
118314	Fedora 27 : mosquitto (2018-a115b0b80e)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-12543

high

Tenable Plugins

high

high

high