Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

Ubuntu 23.04, 22.04 LTS, 20.04 LTS Security Advisory: Mosquitto DoS

ubuntu
Calendar Grey November 21, 2023
Dist Ubuntu Esm H88
Uncover significant Mosquitto flaws impacting various Ubuntu versions and find out how to fortify your setup immediately.
Several security issues were fixed in Mosquitto.

Summary

Several security issues were fixed in Mosquitto.

Software Description:

- mosquitto: MQTT version 3.1/3.1.1 compatible message broker

Details:

Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain

inputs. If a user or an automated system were provided with a specially crafted

input, a remote attacker could possibly use this issue to cause a denial of

service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34431)

Zhanxiang Song discovered that Mosquitto incorrectly handled certain inputs. If

a user or an automated system were provided with a specially crafted input, a

remote attacker could possibly use this issue to cause an authorisation bypass.

This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2021-34434)

Zhanxiang Song, Bin Yuan, DeQing Zou, and Hai Jin discovered that Mosquitto

incorrectly handled certain inputs. If a user or an automated system were

provided with a specially crafted input, a remote attacker could ...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory Ubuntu dos mosquitto authorisation bypass

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   mosquitto                       2.0.11-1.2ubuntu0.1

Ubuntu 22.04 LTS:
   mosquitto                       2.0.11-1ubuntu1.1

Ubuntu 20.04 LTS (Available with Ubuntu Pro):
   mosquitto                       1.6.9-1ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6492-1

CVE-2021-34431, CVE-2021-34434, CVE-2021-41039, CVE-2023-0809,

CVE-2023-28366, CVE-2023-3592

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6492-1

Topics%20covered

Topics Covered

security advisory Ubuntu dos mosquitto authorisation bypass

Package Information

https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1.2ubuntu0.1
https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1ubuntu1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here