==========================================================================
Ubuntu Security Notice USN-6492-1
November 21, 2023

mosquitto vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in Mosquitto.

Software Description:
- mosquitto: MQTT version 3.1/3.1.1 compatible message broker

Details:

Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain
inputs. If a user or an automated system were provided with a specially crafted
input, a remote attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34431)

Zhanxiang Song discovered that Mosquitto incorrectly handled certain inputs. If
a user or an automated system were provided with a specially crafted input, a
remote attacker could possibly use this issue to cause an authorisation bypass.
This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2021-34434)

Zhanxiang Song, Bin Yuan, DeQing Zou, and Hai Jin discovered that Mosquitto
incorrectly handled certain inputs. If a user or an automated system were
provided with a specially crafted input, a remote attacker could possibly use
this issue to cause a denial of service. This issue only affected Ubuntu 20.04
LTS and Ubuntu 22.04 LTS. (CVE-2021-41039)

Zhengjie Du discovered that Mosquitto incorrectly handled certain inputs. If a
user or an automated system were provided with a specially crafted input file,
a remote attacker could possibly use this issue to cause a denial of service.
(CVE-2023-0809)

It was discovered that Mosquitto incorrectly handled certain inputs. If a user
or an automated system were provided with a specially crafted input, a remote
attacker could possibly use this issue to cause a denial of service.
(CVE-2023-3592)

Mischa Bachmann discovered that Mosquitto incorrectly handled certain inputs.
If a user or an automated system were provided with a specially crafted input,
a remote attacker could possibly use this issue to cause a denial of service.
This issue was only fixed in Ubuntu 22.04 LTS and Ubuntu 23.04.
(CVE-2023-28366)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   mosquitto                       2.0.11-1.2ubuntu0.1

Ubuntu 22.04 LTS:
   mosquitto                       2.0.11-1ubuntu1.1

Ubuntu 20.04 LTS (Available with Ubuntu Pro):
   mosquitto                       1.6.9-1ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6492-1
   CVE-2021-34431, CVE-2021-34434, CVE-2021-41039, CVE-2023-0809,
   CVE-2023-28366, CVE-2023-3592

Package Information:
   https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1.2ubuntu0.1
   https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1ubuntu1.1