Advisories » MGASA-2019-0345

Updated mosquitto packages fix security vulnerability

Publication date: 30 Nov 2019
Modification date: 30 Nov 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-11779

Description

Updated mosquitto packages fix security vulnerability:

A vulnerability was discovered in mosquitto, allowing a malicious MQTT
client to cause a denial of service (stack overflow and daemon crash),
by sending a specially crafted SUBSCRIBE packet containing a topic with
a extremely deep hierarchy (CVE-2019-11779).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=25728
• https://www.debian.org/security/2019/dsa-4570
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11779

SRPMS

7/core

• mosquitto-1.6.6-1.mga7