Bug 2065854

Summary:	Request to upgrade EPEL 8 mosquitto version to 2.0.x
Product:	[Fedora] Fedora EPEL	Reporter:	Jos Vos <jos>
Component:	mosquitto	Assignee:	Jonathan Wright <jonathan>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	epel8	CC:	comsec, dbranchini, emanuele, linville, mail, richmattes
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jos Vos 2022-03-18 21:21:41 UTC

Description of problem:

EPEL 8 contains mosquitto 1.6.15.  Please upgrade mosquitto to the next major 2.0.x release.  Current release is 2.0.14 (already in Fedora).

Comment 1 Fabian Affolter 2022-04-06 15:24:53 UTC

Updating mosquitto to > 2 will most likely break existing installations as there are changes for the listener and the plugin systems.

Comment 2 comsec 2023-10-24 18:45:55 UTC

mosquitto 1.6 now has at least 3 new CVEs from August, fixed only in v2 series

https://mosquitto.org/security/

It's now crucial to have mosquitto v2 on EPEL8

You can name the package differently, for example mosquitto2, like redhat does with many incompatible releases.

This way mosquitto 1.6 will never be updated unintentionally

Comment 3 Fedora Admin user for bugzilla script actions 2025-08-15 13:40:17 UTC

This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.

Comment 4 comsec 2026-06-22 16:36:44 UTC

mosquitto 1.6 is EOL and has now a lot of CVEs
you can simply release it for EPEL8 with a diffrent name, as mosquitto2, like redhat does often to avoid breaking existing installations


August 2023: [CVE-2023-0809]: Fix excessive memory being allocated based on malicious initial packets that are not CONNECT packets. Affecting versions 1.5.0 to 2.0.15. Fixed in 2.0.16.
August 2023: [CVE-2023-3592]: Fix memory leak when clients send v5 CONNECT packets with a will message that contains invalid property types. Affecting version 1.6.0 to 2.0.15 Fixed in 2.0.16.
August 2023: [CVE-2023-28366]: Clients sending unacknowledged QoS 2 messages with duplicate message ids cause a memory leak. Affecting versions 1.3.2 to 2.0.15 inclusive, fixed in 2.0.16.
August 2022: Deleting the anonymous group in the dynamic security plugin could lead to a crash. Affecting versions 2.0.0 to 2.0.14 inclusive, fixed in 2.0.15.
August 2021: CVE-2021-34434 Affecting versions 2.0.0 to 2.0.11 inclusive, fixed in 2.0.12.
April 2021: CVE-2021-28166 Affecting versions 2.0.0 to 2.0.9 inclusive, fixed in 2.0.10.
December 2020: Running mosquitto_passwd with the following arguments only mosquitto_passwd -b password_file username password would cause the username to be used as the password. Affecting versions 2.0.0 to 2.0.2 inclusive, fixed in 2.0.3.