libmosquitto1: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any...
CVE-2018-12551 is fixed in 4 products on 1 platform, first by libmosquitto1 1.4.15-2ubuntu0.18.04.1, released March 27, 2019. It is not reported as exploited. Patch Radar priority: Routine.
When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libmosquitto1 · Ubuntu 18.04.6 LTS (bionic) | 1.4.15-2ubuntu0.18.04.1 | libmosquitto1 1.4.15-2ubuntu0.18.04.1 | Mar 27, 2019 |
| libmosquittopp1 · Ubuntu 18.04.6 LTS (bionic) | 1.4.15-2ubuntu0.18.04.1 | libmosquittopp1 1.4.15-2ubuntu0.18.04.1 | Mar 27, 2019 |
| mosquitto · Ubuntu 18.04.6 LTS (bionic) | 1.4.15-2ubuntu0.18.04.1 | mosquitto 1.4.15-2ubuntu0.18.04.1 | Mar 27, 2019 |
| mosquitto-clients · Ubuntu 18.04.6 LTS (bionic) | 1.4.15-2ubuntu0.18.04.1 | mosquitto-clients 1.4.15-2ubuntu0.18.04.1 | Mar 27, 2019 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.