Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2019-11778 →
DEBIAN-CVE-2019-11778
If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which has the potential to cause a crash in some situations.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
mosquitto
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]
Debian:13
mosquitto
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]
Debian:14
mosquitto
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]
Références
- advisory security-tracker.debian.org