UBUNTU-CVE-2024-3935

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-3935

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-3935.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-3935

Related

Published

2024-10-30T12:15:00Z

Modified

2025-04-23T15:17:48Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

References

Affected packages

Ubuntu:Pro:14.04:LTS / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@0.15-2+deb7u3ubuntu0.1+esm1?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.15-2+deb7u3ubuntu0.1+esm1

Affected versions

0.*

0.15-2ubuntu1

0.15-2ubuntu1.1

0.15-2ubuntu1.2

0.15-2+deb7u3ubuntu0.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "0.15-2+deb7u3ubuntu0.1+esm1",
            "binary_name": "libmosquitto0"
        },
        {
            "binary_version": "0.15-2+deb7u3ubuntu0.1+esm1",
            "binary_name": "libmosquitto0-dev"
        },
        {
            "binary_version": "0.15-2+deb7u3ubuntu0.1+esm1",
            "binary_name": "libmosquittopp0"
        },
        {
            "binary_version": "0.15-2+deb7u3ubuntu0.1+esm1",
            "binary_name": "libmosquittopp0-dev"
        },
        {
            "binary_version": "0.15-2+deb7u3ubuntu0.1+esm1",
            "binary_name": "mosquitto"
        },
        {
            "binary_version": "0.15-2+deb7u3ubuntu0.1+esm1",
            "binary_name": "mosquitto-clients"
        },
        {
            "binary_version": "0.15-2+deb7u3ubuntu0.1+esm1",
            "binary_name": "python-mosquitto"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@1.4.8-1ubuntu0.16.04.7+esm1?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.8-1ubuntu0.16.04.7+esm1

Affected versions

1.*

1.4.3-1

1.4.4-1

1.4.7-1

1.4.8-1

1.4.8-1build1

1.4.8-1ubuntu0.16.04.1

1.4.8-1ubuntu0.16.04.2

1.4.8-1ubuntu0.16.04.3

1.4.8-1ubuntu0.16.04.4

1.4.8-1ubuntu0.16.04.5

1.4.8-1ubuntu0.16.04.6

1.4.8-1ubuntu0.16.04.7

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquitto-dev"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquitto-dev-dbgsym"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquitto1"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquitto1-dbg"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquitto1-dbgsym"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquittopp-dev"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquittopp-dev-dbgsym"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquittopp1"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquittopp1-dbg"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "libmosquittopp1-dbgsym"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "mosquitto"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "mosquitto-clients"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "mosquitto-clients-dbgsym"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "mosquitto-dbg"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "mosquitto-dbgsym"
        },
        {
            "binary_version": "1.4.8-1ubuntu0.16.04.7+esm1",
            "binary_name": "mosquitto-dev"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@1.4.15-2ubuntu0.18.04.3+esm1?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.15-2ubuntu0.18.04.3+esm1

Affected versions

1.*

1.4.12-1

1.4.14-1

1.4.14-2

1.4.14-2build1

1.4.15-1

1.4.15-2

1.4.15-2ubuntu0.18.04.1

1.4.15-2ubuntu0.18.04.2

1.4.15-2ubuntu0.18.04.3

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "libmosquitto-dev"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "libmosquitto1"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "libmosquitto1-dbg"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "libmosquittopp-dev"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "libmosquittopp1"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "libmosquittopp1-dbg"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "mosquitto"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "mosquitto-clients"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "mosquitto-dbg"
        },
        {
            "binary_version": "1.4.15-2ubuntu0.18.04.3+esm1",
            "binary_name": "mosquitto-dev"
        }
    ]
}

Ubuntu:20.04:LTS / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@1.6.9-1?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.9-1

Affected versions

1.*

1.6.6-1

1.6.7-1

1.6.8-1

1.6.8-2

1.6.9-1~build1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.6.9-1",
            "binary_name": "libmosquitto-dev"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "libmosquitto1"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "libmosquitto1-dbgsym"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "libmosquittopp-dev"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "libmosquittopp1"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "libmosquittopp1-dbgsym"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "mosquitto"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "mosquitto-clients"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "mosquitto-clients-dbgsym"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "mosquitto-dbgsym"
        },
        {
            "binary_version": "1.6.9-1",
            "binary_name": "mosquitto-dev"
        }
    ]
}

Ubuntu:Pro:20.04:LTS / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@1.6.9-1ubuntu0.1~esm1?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.9-1ubuntu0.1~esm1

Affected versions

1.*

1.6.6-1

1.6.7-1

1.6.8-1

1.6.8-2

1.6.9-1~build1

1.6.9-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "libmosquitto-dev"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "libmosquitto1"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "libmosquitto1-dbgsym"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "libmosquittopp-dev"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "libmosquittopp1"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "libmosquittopp1-dbgsym"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "mosquitto"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "mosquitto-clients"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "mosquitto-clients-dbgsym"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "mosquitto-dbgsym"
        },
        {
            "binary_version": "1.6.9-1ubuntu0.1~esm1",
            "binary_name": "mosquitto-dev"
        }
    ]
}

Ubuntu:22.04:LTS / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@2.0.11-1ubuntu1.2?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.11-1ubuntu1.2

Affected versions

2.*

2.0.11-1

2.0.11-1build1

2.0.11-1ubuntu1

2.0.11-1ubuntu1.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "libmosquitto-dev"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "libmosquitto1"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "libmosquitto1-dbgsym"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "libmosquittopp-dev"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "libmosquittopp1"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "libmosquittopp1-dbgsym"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "mosquitto"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "mosquitto-clients"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "mosquitto-clients-dbgsym"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "mosquitto-dbgsym"
        },
        {
            "binary_version": "2.0.11-1ubuntu1.2",
            "binary_name": "mosquitto-dev"
        }
    ]
}

Ubuntu:24.10 / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@2.0.18-1.1?arch=source&distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.18-1build3

2.0.18-1.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@2.0.18-1build3?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.18-1

2.0.18-1build1

2.0.18-1build2

2.0.18-1build3

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:24.04:LTS / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@2.0.18-1ubuntu0.1~esm1?arch=source&distro=esm-apps/noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.18-1ubuntu0.1~esm1

Affected versions

2.*

2.0.18-1

2.0.18-1build1

2.0.18-1build2

2.0.18-1build3

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "libmosquitto-dev"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "libmosquitto1"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "libmosquitto1-dbgsym"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "libmosquittopp-dev"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "libmosquittopp1"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "libmosquittopp1-dbgsym"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "mosquitto"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "mosquitto-clients"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "mosquitto-clients-dbgsym"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "mosquitto-dbgsym"
        },
        {
            "binary_version": "2.0.18-1ubuntu0.1~esm1",
            "binary_name": "mosquitto-dev"
        }
    ]
}

Ubuntu:25.04 / mosquitto

Package

Name: mosquitto
Purl: pkg:deb/ubuntu/mosquitto@2.0.21-1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.21-1

Affected versions

2.*

2.0.18-1.1

2.0.20-1

2.0.20-2

2.0.20-3

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.0.21-1",
            "binary_name": "libmosquitto-dev"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "libmosquitto1"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "libmosquitto1-dbgsym"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "libmosquittopp-dev"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "libmosquittopp1"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "libmosquittopp1-dbgsym"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "mosquitto"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "mosquitto-clients"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "mosquitto-clients-dbgsym"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "mosquitto-dbgsym"
        },
        {
            "binary_version": "2.0.21-1",
            "binary_name": "mosquitto-dev"
        }
    ]
}