Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Fedora 38: FEDORA-2023-6a87c003c4 Critical Memory Leak in libwebsockets

fedora
Calendar Grey September 1, 2023
Dist Fedora Esm H88
Crucial update for Fedora 38 addresses a range of vulnerabilities in libwebsockets, effectively managing memory issues and improving client handling.
2.0.17 Broker: * Fix `max_queued_messages 0` stopping clients from receiving messages * Fix `max_inflight_messages` not being set correctly

Summary

This is the libwebsockets C library for lightweight websocket clients and

servers.

Update Information:

2.0.17 Broker: * Fix `max_queued_messages 0` stopping clients from receiving messages * Fix `max_inflight_messages` not being set correctly. Apps: * Fix `mosquitto_passwd -U` backup file creation. 2.0.16 Security: * CVE-2023-28366: Fix memory leak in broker when clients send multiple QoS 2 messages with the same message ID, but then never respond to the PUBREC commands. * CVE-2023-0809: Fix excessive memory being allocated based on malicious initial packets that are not CONNECT packets. * CVE-2023-3592: Fix memory leak when clients send v5 CONNECT packets with a will message that contains invalid property types. * Broker will now reject Will messages that attempt to publish to $CONTROL/. * Broker now validates usernames provided in a TLS certificate or TLS-PSK identity are valid UTF-8. * Fix potential crash when loading invalid persistence file. * Library will no longer allow single level wildcard certificates, e.g. *.com Broker: * Fix $SYS messages being expir...

Topics%20covered

Topics Covered

security advisory critical issue Fedora memory leak libwebsockets client management broker fix

Change Log

* Fri Aug 18 2023 Peter Robinson - 4.3.2-5 - Upstream patches for OpenSSLv3 * Thu Jul 20 2023 Fedora Release Engineering - 4.3.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Thu Jan 19 2023 Fedora Release Engineering - 4.3.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

References


[ 1 ] Bug #2171596 - libwebsockets: FTBFS in Fedora rawhide/f38 https://bugzilla.redhat.com/show_bug.cgi?id=2171596

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-6a87c003c4' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
critical
Lowest
Low
Medium
High
Critical

Name: libwebsockets
Product: Fedora 38
Version: 4.3.2
Release: 5.fc38
URL: https://libwebsockets.org/
Summary: Lightweight C library for Websockets

Topics%20covered

Topics Covered

security advisory critical issue Fedora memory leak libwebsockets client management broker fix

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here