Security Update for mosquitto
Summary
DLA-1146-1: mosquitto - security update. Affects mosquitto versions < 0.15-2+deb7u2. Fixed in 0.15-2+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mosquitto is an open-source message broker that implements the MQTT (Message Queuing Telemetry Transport) protocol. It allows devices to communicate with each other via a publish-subscribe pattern. Mosquitto's persistence file, mosquitto.db, was created with world-readable permissions, which allowed local users to access sensitive MQTT topic information. Although the application has been fixed to set proper permissions by default, existing files still require manual permission adjustments.
Vulnerability Detail
The vulnerability in mosquitto arises from the world-readable permissions set on the persistence file, mosquitto.db. This allows local users to obtain sensitive MQTT topic information. The issue has been addressed in version 0.15-2+deb7u2 of the Debian 7 Wheezy package. The vulnerability could potentially lead to unauthorized access to MQTT topic data, compromising the confidentiality of the information being transmitted.
How To Fix
Minimum fixed version
0.15-2+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mosquittoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade the mosquitto package and adjust the permissions on existing mosquitto.db files.
Conclusion
The mosquitto package has been updated to address the vulnerability related to the world-readable permissions on the mosquitto.db file. It is crucial to upgrade to the fixed version and adjust permissions on existing files to ensure the confidentiality of MQTT topic information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mosquitto →
FAQ
Mosquitto is an open-source message broker that implements the MQTT protocol, allowing devices to communicate via a publish-subscribe pattern.
The vulnerability allows local users to access sensitive MQTT topic information, potentially compromising the confidentiality of the transmitted data.
You can fix the vulnerability by upgrading your mosquitto packages to version 0.15-2+deb7u2 or later. Additionally, ensure that the permissions on existing mosquitto.db files are adjusted to prevent world-readable access.
There is no specific workaround mentioned for this vulnerability. Upgrading the mosquitto package and adjusting file permissions are the recommended solutions.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for mosquitto.
