Bug 1119238
| Summary: | mosquitto does not handle errors from authentication plugins correctly | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Roger Light <roger> | ||||
| Component: | mosquitto | Assignee: | Rich Mattes <richmattes> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | rawhide | CC: | mail, richmattes | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | mosquitto-1.3.2-1.fc19 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2014-08-07 15:35:44 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Note that this also would affect Fedora 19 and 20, as well as EPEL7. mosquitto-1.3.2-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/mosquitto-1.3.2-1.fc20 mosquitto-1.3.2-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/mosquitto-1.3.2-1.fc19 Package mosquitto-1.3.2-1.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing mosquitto-1.3.2-1.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-8412/mosquitto-1.3.2-1.fc20 then log in and leave karma (feedback). mosquitto-1.3.2-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. mosquitto-1.3.2-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. |
Created attachment 917750 [details] Patch This is a security related bug affecting versions 1.0 - 1.3.1 of mosquitto. If an end user uses mosquitto with an authentication plugin, and the plugin returns an application error when making an authentication check (such as if a database was unavailable), then mosquitto incorrectly treats this as a successful authentication. This has the potential for unauthorised clients to access the running mosquitto broker and gain access to information to which it is not authorised. In general this does not represent a wider security hole. No authentication plugins are provided with mosquitto and there are only a limited number of examples available on the internet, so it is unlikely that this bug will affect many installations. The attached patch can be used as a fix, or package version 1.3.2.