Roger A. Light
6 years ago
commit
8c9e448d5c
@ -0,0 +1,36 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# Test whether a SUBSCRIBE to a topic with 65535 hierarchy characters fails
|
||||
# This needs checking with MOSQ_USE_VALGRIND=1 to detect memory failures
|
||||
# https://github.com/eclipse/mosquitto/issues/1412
|
||||
|
||||
from mosq_test_helper import *
|
||||
|
||||
rc = 1
|
||||
mid = 1
|
||||
keepalive = 60
|
||||
connect_packet = mosq_test.gen_connect("subscribe-long-test", keepalive=keepalive)
|
||||
connack_packet = mosq_test.gen_connack(rc=0)
|
||||
|
||||
subscribe_packet = mosq_test.gen_subscribe(mid, "/"*65535, 0)
|
||||
suback_packet = mosq_test.gen_suback(mid, 0)
|
||||
|
||||
port = mosq_test.get_port()
|
||||
broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port)
|
||||
|
||||
try:
|
||||
sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port)
|
||||
mosq_test.do_send_receive(sock, subscribe_packet, b"", "suback")
|
||||
|
||||
rc = 0
|
||||
|
||||
sock.close()
|
||||
finally:
|
||||
broker.terminate()
|
||||
broker.wait()
|
||||
(stdo, stde) = broker.communicate()
|
||||
if rc:
|
||||
print(stde.decode('utf-8'))
|
||||
|
||||
exit(rc)
|
||||
|
||||
@ -0,0 +1,37 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# Test whether a PUBLISH to a topic with 65535 hierarchy characters fails
|
||||
# This needs checking with MOSQ_USE_VALGRIND=1 to detect memory failures
|
||||
# https://github.com/eclipse/mosquitto/issues/1412
|
||||
|
||||
|
||||
from mosq_test_helper import *
|
||||
|
||||
rc = 1
|
||||
mid = 19
|
||||
keepalive = 60
|
||||
connect_packet = mosq_test.gen_connect("pub-qos1-test", keepalive=keepalive)
|
||||
connack_packet = mosq_test.gen_connack(rc=0)
|
||||
|
||||
publish_packet = mosq_test.gen_publish("/"*65535, qos=1, mid=mid, payload="message")
|
||||
puback_packet = mosq_test.gen_puback(mid)
|
||||
|
||||
port = mosq_test.get_port()
|
||||
broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port)
|
||||
|
||||
try:
|
||||
sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port)
|
||||
mosq_test.do_send_receive(sock, publish_packet, b"", "puback")
|
||||
|
||||
rc = 0
|
||||
|
||||
sock.close()
|
||||
finally:
|
||||
broker.terminate()
|
||||
broker.wait()
|
||||
(stdo, stde) = broker.communicate()
|
||||
if rc:
|
||||
print(stde.decode('utf-8'))
|
||||
|
||||
exit(rc)
|
||||
|
||||
@ -0,0 +1,52 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# Test whether a client that connects with a will delay that is shorter than
|
||||
# their session expiry interval has their will published.
|
||||
# MQTT 5
|
||||
# https://github.com/eclipse/mosquitto/issues/1401
|
||||
|
||||
from mosq_test_helper import *
|
||||
|
||||
rc = 1
|
||||
keepalive = 60
|
||||
|
||||
mid = 1
|
||||
connect1_packet = mosq_test.gen_connect("will-test", keepalive=keepalive, proto_ver=5)
|
||||
connack1_packet = mosq_test.gen_connack(rc=0, proto_ver=5)
|
||||
|
||||
will_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_WILL_DELAY_INTERVAL, 2)
|
||||
connect_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_SESSION_EXPIRY_INTERVAL, 4)
|
||||
|
||||
connect2_packet = mosq_test.gen_connect("will-helper", keepalive=keepalive, proto_ver=5, properties=connect_props, will_topic="will/test", will_payload=b"will delay", will_qos=2, will_properties=will_props)
|
||||
connack2_packet = mosq_test.gen_connack(rc=0, proto_ver=5)
|
||||
|
||||
subscribe_packet = mosq_test.gen_subscribe(mid, "will/test", 0, proto_ver=5)
|
||||
suback_packet = mosq_test.gen_suback(mid, 0, proto_ver=5)
|
||||
|
||||
publish_packet = mosq_test.gen_publish("will/test", qos=0, payload="will delay", proto_ver=5)
|
||||
|
||||
port = mosq_test.get_port()
|
||||
broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port)
|
||||
|
||||
try:
|
||||
sock1 = mosq_test.do_client_connect(connect1_packet, connack1_packet, timeout=30, port=port, connack_error="connack1")
|
||||
mosq_test.do_send_receive(sock1, subscribe_packet, suback_packet, "suback")
|
||||
|
||||
sock2 = mosq_test.do_client_connect(connect2_packet, connack2_packet, timeout=30, port=port, connack_error="connack2")
|
||||
time.sleep(1)
|
||||
sock2.close()
|
||||
|
||||
# Wait for session to expire
|
||||
time.sleep(3)
|
||||
if mosq_test.expect_packet(sock1, "publish", publish_packet):
|
||||
rc = 0
|
||||
|
||||
sock1.close()
|
||||
finally:
|
||||
broker.terminate()
|
||||
broker.wait()
|
||||
(stdo, stde) = broker.communicate()
|
||||
if rc:
|
||||
print(stde.decode('utf-8'))
|
||||
exit(rc)
|
||||
|
||||
@ -0,0 +1,59 @@
|
||||
<!--
|
||||
.. title: Security advisory: CVE-2018-12543
|
||||
.. slug: security-advisory-cve-2018-12543
|
||||
.. date: 2018-09-27 10:36:19 UTC+01:00
|
||||
.. tags: Security,Releases
|
||||
.. category:
|
||||
.. link:
|
||||
.. description:
|
||||
.. type: text
|
||||
-->
|
||||
|
||||
Mosquitto 1.6.6 and 1.5.9 have been released to address two security vulnerabilities.
|
||||
|
||||
Titles and links will be updated once the CVE numbers are assigned.
|
||||
|
||||
# CVE-xxxx-xxxxx
|
||||
|
||||
A vulnerability exists in Mosquitto versions 1.5 to 1.6.5 inclusive.
|
||||
|
||||
If a client sends a SUBSCRIBE packet containing a topic that consists of
|
||||
approximately 65400 or more '/' characters, i.e. the topic hierarchy separator,
|
||||
then a stack overflow will occur.
|
||||
|
||||
The issue is fixed in Mosquitto 1.6.6 and 1.5.9. Patches for older versions are
|
||||
available at <https://mosquitto.org/files/cve/2019-hier>
|
||||
|
||||
The fix addresses the problem by restricting the allowed number of topic
|
||||
hierarchy levels to 200. An alternative fix is to increase the size of the
|
||||
stack by a small amount.
|
||||
|
||||
# CVE-yyyy-yyyyy
|
||||
|
||||
A vulnerability exists in Mosquitto version 1.6 to 1.6.4 inclusive.
|
||||
|
||||
If an MQTT v5 client connects to Mosquitto, sets a last will and testament,
|
||||
sets a will delay interval, sets a session expiry interval, and the will delay
|
||||
interval is set longer than the session expiry interval, then a use after free
|
||||
error occurs, which has the potential to cause a crash in some situations.
|
||||
|
||||
The issue is fixed in Mosquitto 1.6.5. Patches for older versions are available
|
||||
at <https://mosquitto.org/files/cve/2019-will-delay>
|
||||
|
||||
# Version 1.6.6 Changes
|
||||
|
||||
The complete list of fixes addressed in version 1.6.6 is:
|
||||
|
||||
## Security
|
||||
|
||||
* Restrict topic hierarchy to 200 levels to prevent possible stack overflow.
|
||||
Closes [#1412].
|
||||
|
||||
## Broker
|
||||
* Restrict topic hierarchy to 200 levels to prevent possible stack overflow.
|
||||
Closes [#1412].
|
||||
* `mosquitto_passwd` now returns 1 when attempting to update a user that does
|
||||
not exist. Closes [#1414].
|
||||
|
||||
[#1412]: https://github.com/eclipse/mosquitto/issues/1412
|
||||
[#1414]: https://github.com/eclipse/mosquitto/issues/1414
|
||||
Loading…
Reference in New Issue