Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2018-20145 →

DEBIAN-CVE-2018-20145

Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 mosquitto

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.5-1"}]}]

Debian:13 mosquitto

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.5-1"}]}]

Debian:14 mosquitto

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.5-1"}]}]

Références

advisory security-tracker.debian.org