Skip to content
OpenAdvisories
High · 7.2 CVE-2024-8376 EUVD-2024-49133GHSA-72qw-2vp3-gvg9

Memory leak

Published Oct 11, 2024 · Updated Oct 31, 2024 · Assigned by eclipse

Vendor: Eclipse Foundation Product: Mosquitto Package: mosquitto Package: mosquitto Ecosystem: Debian Ecosystem: Ubuntu

Description

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.

Affected products

VendorProductAffectedFixed
Eclipse Foundation Mosquitto 2.0.18 2.0.19

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 mosquitto 2.0.20-1 —
Debian 13 mosquitto 2.0.20-1 —
Debian 12 mosquitto 2.0.11-1.2+deb12u2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS mosquitto No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS mosquitto No fix yet —
Ubuntu Pro 20.04 LTS mosquitto No fix yet —
Ubuntu Pro 18.04 LTS mosquitto No fix yet —
Ubuntu Pro 16.04 LTS mosquitto No fix yet —
Ubuntu Pro 14.04 LTS mosquitto No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Utils 6 foreman +1 3.7.0.14-1.el8sat RHSA-2024:8906, RHSA-2024:8719, RHSA-2024:8718
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite 4.2.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite_operations 3.0.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansible-lint 5.4.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 ansible-runner +1 2.2.1-6.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansiblerole-foreman_scap_client 0.3.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 ansiblerole-insights-client 1.7.1-2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 cjson 1.7.17-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 createrepo_c +3 1.1.3-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 dynflow-utils 1.6.3-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman +1 3.7.0.14-1.el8sat RHSA-2024:8906, RHSA-2024:8719, RHSA-2024:8718
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 202102220000-3.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-discovery-image 1:4.1.0-61.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-discovery-image-service +1 1.0.0-4.1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-fapolicyd +1 1.0.1-3.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-installer +1 1:3.12.0.1-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 foreman-pcp 3.9.1.11-1.el8sat RHSA-2024:8906, RHSA-2024:8719
Red Hat Satellite Capsule 6 foreman-proxy +1 3.12.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 katello +3 4.14.0-0.1.rc2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 katello-certs-tools 2.10.0-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.7.9-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 libcomps +2 0.1.21-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 libsolv +1 1:0.7.20-6.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 mosquitto 2.0.19-1.el8sat RHSA-2024:8906, RHSA-2024:8719, RHSA-2024:8718
Red Hat Satellite Capsule 6 pulpcore-obsolete-packages 1.2.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 pulpcore-selinux 2.0.1-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 puppet-agent 8.8.1-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 puppet-agent-oauth 0.5.10-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 1.0.0-2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 puppetlabs-stdlib 9.4.1-1.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 puppetserver 8.6.2-2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiodns +1 3.0.0-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiofiles +1 22.1.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiohttp +1 3.9.4-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiohttp-xmlrpc +1 1.5.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aioredis +1 2.0.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-aiosignal +1 1.3.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ansible-builder +1 3.0.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-asgiref +1 3.6.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-async-lru +1 1.0.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-async-timeout +1 4.0.2-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-asyncio-throttle +1 1.0.2-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-attrs +1 21.4.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-backoff +1 2.2.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-bindep +1 2.11.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-bleach +1 3.3.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-bleach-allowlist +1 1.0.3-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-bracex +1 2.2.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-brotli +1 1.0.9-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-certifi +1 2022.12.7-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-cffi +1 1.15.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-chardet +1 5.0.0-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-charset-normalizer +1 2.1.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-click +1 8.1.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-click-shell +1 2.1-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-colorama +1 0.4.4-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-commonmark +1 0.9.1-9.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-contextlib2 +1 21.6.0-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-cryptography +1 42.0.8-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-daemon +1 2.3.1-3.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 python-dataclasses +1 0.8-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-dateutil +1 2.8.2-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-debian +1 0.1.44-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-defusedxml +1 0.7.1-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-deprecated +1 1.2.13-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-diff-match-patch +1 20200713-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-distro +1 1.7.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django +1 4.2.16-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django-filter +1 23.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django-guid +1 3.3.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django-lifecycle +1 1.0.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-django-readonly-field +1 1.1.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-djangorestframework +1 3.14.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-djangorestframework-queryfields +1 1.0.0-8.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-docutils +1 0.20.1-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-drf-access-policy +1 1.3.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-drf-nested-routers +1 0.93.4-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-drf-spectacular +1 0.26.5-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-dynaconf +1 3.1.12-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ecdsa +1 0.18.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-enrich +1 1.2.6-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-et-xmlfile +1 1.1.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-flake8 +1 5.0.0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-frozenlist +1 1.3.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-future +1 0.18.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-galaxy-importer +1 0.4.19-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-gitdb +1 4.0.10-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-gitpython +1 3.1.40-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-gnupg +1 0.5.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-googleapis-common-protos +1 1.59.1-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-grpcio +1 1.65.4-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-gunicorn +1 22.0.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-importlib-metadata +1 6.0.1-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-inflection +2 0.5.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-iniparse +1 0.4-39.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-jinja2 +1 3.1.4-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-jq +1 1.6.0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-json-stream +1 2.3.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-json-stream-rs-tokenizer +1 0.4.25-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-jsonschema +1 4.10.3-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-lockfile +1 0.12.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-lxml +1 4.9.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-markdown +1 3.4.1-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-markuppy +1 1.14-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-markupsafe +1 2.1.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-mccabe +1 0.7.0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-multidict +1 6.0.4-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-odfpy +1 1.4.1-9.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-openpyxl +3 3.1.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_api +2 1.19.0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_distro +2 0.40b0-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_exporter_otlp_proto_grpc +1 1.19.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_instrumentation 0.40b0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_instrumentation_wsgi +1 0.40b0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_sdk +3 1.19.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-opentelemetry_util_http +1 0.40b0-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-packaging 21.3-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-parsley 1.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pbr 5.8.0-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pexpect 4.8.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pillow 10.3.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-productmd 1.33-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-protobuf 4.21.6-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-psycopg 3.1.9-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ptyprocess 0.7.0-2.el8sat RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-ansible 1:0.21.8-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-cli +1 0.27.2-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-container 2.20.2-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-deb 3.2.1-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-file 1.15.1-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp-rpm 3.26.1-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulp_manifest 3.0.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pulpcore 3.49.19-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyOpenSSL 24.1.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pycares 4.1.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pycodestyle 2.9.1-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pycparser 2.21-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pycryptodomex 3.20.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyflakes 2.5.0-2.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pygments 2.17.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyjwkest 1.4.2-8.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyjwt +1 2.5.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyparsing 3.1.1-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pyrsistent 0.18.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-pytz 2022.2.1-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-redis 4.3.4-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-requests 2.31.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-requirements-parser 0.2.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-rhsm 1.19.2-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-rich 13.3.1-7.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ruamel-yaml 0.17.21-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-ruamel-yaml-clib 0.2.7-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-schema 0.7.5-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-semantic-version 2.10.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-six 1.16.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-smmap 5.0.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-solv 0.7.28-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-sqlparse 0.5.0-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-tablib 3.3.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-tenacity 7.0.0-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-toml 0.10.2-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-types-cryptography 3.3.23.2-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-typing-extensions 4.7.1-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-uritemplate 4.1.1-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-url-normalize 1.4.3-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-urllib3 2.2.3-1.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-urlman 2.0.1-3.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-uuid6 2023.5.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-wcmatch 8.3-5.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-whitenoise 6.0.0-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-wrapt 1.14.1-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-xlrd 2.0.1-8.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-xlwt 1.3.0-6.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-yarl 1.8.2-4.el8pc RHSA-2024:8906
Red Hat Satellite Capsule 6 python-zipp +1 3.20.2-1.el8pc RHSA-2024:8906
Red Hat Satellite 6 foreman +13 3.7.0.14-1.el8sat RHSA-2024:8906, RHSA-2024:8719, RHSA-2024:8718
Red Hat Satellite 6 foreman-installer +1 1:3.12.0.1-1.el8sat RHSA-2024:8906
Red Hat Satellite 6 foreman-pcp 3.9.1.11-1.el8sat RHSA-2024:8906, RHSA-2024:8719
Red Hat Satellite 6 mosquitto 2.0.19-1.el8sat RHSA-2024:8906, RHSA-2024:8719, RHSA-2024:8718
Red Hat Satellite 6 python-grpcio +1 1.65.4-1.el8pc RHSA-2024:8906
Red Hat Satellite 6 python-zipp +1 3.20.2-1.el8pc RHSA-2024:8906

Advisories 6

References