Detections
Analytics

Fedora 29 : mosquitto (2019-d99e2329cb)

medium Nessus Plugin ID 129652

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

1.6.7 =====

Broker :

 - Add workaround for working with libwebsockets 3.2.0.

 - Fix potential crash when reloading config.

Client library :

 - Don't use / in autogenerated client ids, to avoid confusing with topics.

 - Fix mosquitto_max_inflight_messages_set() and mosquitto_int_option(..., MOSQ_OPT_*_MAX, ...) behaviour.

 - Fix regression on use of mosquitto_connect_async() not working.

Clients :

 - mosquitto_sub: Fix -E incorrectly not working unless -d was also specified.

 - Updated documentation around automatic client ids.

1.6.6 =====

Security :

 - CVE-2019-11779

 - Restrict topic hierarchy to 200 levels to prevent possible stack overflow.

Broker :

 - Restrict topic hierarchy to 200 levels to prevent possible stack overflow.

 - mosquitto_passwd now returns 1 when attempting to update a user that does not exist.

1.6.5 =====

Broker :

 - Fix v5 DISCONNECT packets with remaining length == 2 being treated as a protocol error.

 - Fix support for libwebsockets 3.x.

 - Fix slow websockets performance when sending large messages.

 - Fix bridges potentially not connecting on Windows.

 - Fix clients authorised using `use_identity_as_username` or `use_subject_as_username` being disconnected on SIGHUP.

 - Improve error messages in some situations when clients disconnect. Reduces the number of 'Socket error on client X, disconnecting' messages.

 - Fix Will for v5 clients not being sent if will delay interval was greater than the session expiry interval.

 - Fix CRL file not being reloaded on HUP.

 - Fix repeated 'Error in poll' messages on Windows when only websockets listeners are defined.

Client library :

 - Fix reconnect backoff for the situation where connections are dropped rather than refused.

 - Fix missing locks on `mosq->state`.

Documentation :

 - Improve details on global/per listener options in the mosquitto.conf man page.

 - Clarify behaviour when clients exceed the `message_size_limit`.

 - Improve documentation for `max_inflight_bytes`, `max_inflight_messages`, and `max_queued_messages`.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected mosquitto package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2019-d99e2329cb

Plugin Details

Severity: Medium

ID: 129652

File Name: fedora_2019-d99e2329cb.nasl

Version: 1.4

Type: local

Agent: unix

Published: 10/7/2019

Updated: 4/19/2024

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS Score Source: CVE-2019-11779

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:mosquitto, cpe:/o:fedoraproject:fedora:29

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/4/2019

Vulnerability Publication Date: 9/19/2019

Reference Information

CVE: CVE-2019-11779