CVE-2021-28166
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker,...
Original description
The description as published by the source.
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2021-28166 mosquitto Fixed in: 2.0.10-r0
- Debian DEBIAN-CVE-2021-28166 mosquitto Fixed in: 2.0.10-1
References
- patch bugs.eclipse.org