A flaw was found in mosquitto affecting versions from 1.0 to 1.4.14 inclusive. If the broker has exhausted all of its free sockets/file descriptors and then a SIGHUP signal is received to trigger reloading of the configuration, then the reloading will fail. This results in many of the configuration options, including security options, being set to their default value. This means that authorization and access control may no longer be in place. References: https://bugzilla.redhat.com/show_bug.cgi?id=1549665 https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/ Upstream Patch: https://mosquitto.org/files/cve/2017-7652/
Created mosquitto tracking bugs for this issue: Affects: fedora-all [bug 1551744] Affects: epel-7 [bug 1551745]