CVE-2017-7651 and CVE-2017-7652

[Matthew Treinish]

The current available version of mosquitto pacakged in ubuntu (for all versions) is vulnerable to 2 cve's announced recently, including one for a potential DOS attach from unauthorized users. More details on this can be found at: https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/ which includes links to patches for the CVEs. Or we can just update to 1.4.15 which should be backwards compatible.

[Matthew Treinish (treinish)]

Marked as public security because the CVEs have been disclosed

[Matthew Treinish (treinish)]

Debdiff from Emmet for fixing CVE 2017-7651 for Artful

[Matthew Treinish (treinish)]

Debdiff from Emmet for fixing CVE 2017-7651 for Xenial

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "mosquitto_1.4.12-1ubuntu1.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Emmet Hikory (persia)]

For clarity, the current debdiffs only address CVE 2017-7651, and I probably didn't add the right metadata to the changelog. I did not find the patches for CVE 2017-7652 to be trivial to port to the versions of mosquitto in Ubuntu artful or xenial. Bionic is not vulnerable to either, as a result of a recent sync from Debian. The use case I am supporting is largely unconcerned about the risk from CVE 2017-7652, so I am unlikely to put any effort into backporting that fix (and would prefer a separation of resolution for 7651 vs. 7652 unless if feels really easy to someone else (as 7651 is an immediate issue that likely affects xenial and bionic users).

Anyone who has a current understanding of the correct metadata to put in debian/changelog is welcome to replace my debdiffs with corrected ones, including removal of my name from the changes if preferred (or leaving my name despite debian/changelog modification, if blaming me feels better at the time).

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Marc Deslauriers (mdeslaur)]

ACK on the debdiffs in comments #2 and #3. I added the bug number to the changelog and adjusted the artful versioning.

Packages are building now and will be released as security updates today.

Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package mosquitto - 1.4.12-1ubuntu0.1

---------------
mosquitto (1.4.12-1ubuntu0.1) artful-security; urgency=medium

  * Add upstream patch for CVE 2017-7651 (LP: #1752591)

 -- Emmet Hikory <email address hidden> Thu, 01 Mar 2018 09:24:46 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package mosquitto - 1.4.8-1ubuntu0.16.04.3

---------------
mosquitto (1.4.8-1ubuntu0.16.04.3) xenial-security; urgency=medium

  * SECURITY UPDATE: upstream patch for CVE 2017-7651 (LP: #1752591)

 -- Emmet Hikory <email address hidden> Thu, 01 Mar 2018 09:34:49 -0500

[Emmet Hikory (persia)]

Thanks for the cleanup Marc :)