[ubuntu/trusty-security] mosquitto 0.15-2+deb7u3ubuntu0.1 (Accepted)

[Eduardo dos Santos Barretto]

mosquitto (0.15-2+deb7u3ubuntu0.1) trusty-security; urgency=medium

  * Merge from Debian. Remaining changes:
    - Install apparmor profile.
    - Replace init script with upstart script.

mosquitto (0.15-2+deb7u3) wheezy-security; urgency=high

  * Non-maintainer upload by the Wheezy LTS Team. 
  * CVE-2017-7651
    fix to avoid extraordinary memory consumption by crafted 
    CONNECT packet from unauthenticated client
  * CVE-2017-7652
    in case all sockets/file descriptors are exhausted, this is a 
    fix to avoid default config values after reloading configuration
    by SIGHUP signal

mosquitto (0.15-2+deb7u2) wheezy-security; urgency=high

  * SECURITY UPDATE: Persistence file is world readable, which may expose
    sensitive data.
    - debian/patches/mosquitto-0.15_cve-2017-9868.patch: Set umask to
      restrict persistence file read access to owner.
    - CVE-2017-9868

mosquitto (0.15-2+deb7u1) wheezy-security; urgency=high

  * SECURITY UPDATE: Pattern ACL can be bypassed by using a username/client id
    set to '+' or '#'.
    - debian/patches/mosquitto-1.3.4_cve-2017-7650.patch: Reject send/receive
      of messages to/from clients with a '+', '#' or '/' in their
      username/client id.
    - CVE-2017-7650

Date: 2018-09-05 15:11:24.589193+00:00
Changed-By: Eduardo dos Santos Barretto <eduardo.barretto at canonical.com>
https://launchpad.net/ubuntu/+source/mosquitto/0.15-2+deb7u3ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.