Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Old security issue not fixed #1084

Closed
tardyp opened this issue Mar 19, 2021 · 1 comment
Closed

Old security issue not fixed #1084

tardyp opened this issue Mar 19, 2021 · 1 comment
Labels
fix added
Milestone
1.3.9

Comments

@tardyp
Copy link

tardyp commented Mar 19, 2021

Hello,
While looking for public security issue for this library I found that there is no CVE assigned to it and actually no CPE (product identifier).

We can still find some evidence that there has been at least one security report, which was later disclosed.

https://bugs.eclipse.org/bugs/show_bug.cgi?id=543626
https://bugzillaattachments.eclipsecontent.org/bugs/attachment.cgi?id=277237

While studying the security report, and the actual code in the mainline, I dont find any evidence that the issue is actually fixed.

There report actually describe two issues. Awaiting some more feedback before creating specific bugs.
icraggs added a commit that referenced this issue Mar 22, 2021
@icraggs
Check for msgid data length in incoming packets #1084
a7f0e9a
@icraggs
Copy link
Contributor

icraggs commented Mar 22, 2021

Thanks for pointing this out. I thought I'd fixed the packet data handling previously but evidently not. I've added a fix now.

The second part is not actually achievable in practise.

@icraggs icraggs added this to the 1.3.9 milestone Mar 22, 2021
@icraggs icraggs modified the milestones: 1.4.0, 1.3.9 Apr 12, 2021
@icraggs icraggs closed this as completed May 26, 2021
buildroot-auto-update pushed a commit to buildroot/buildroot that referenced this issue May 27, 2021
@ffontaine @jacmet
package/paho-mqtt-c: security bump to version 1.3.9
9dad1ef 
Old security issue not fixed:
eclipse/paho.mqtt.c#1084

https://github.com/eclipse/paho.mqtt.c/milestone/16?closed=1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
buildroot-auto-update pushed a commit to buildroot/buildroot that referenced this issue Jun 9, 2021
@ffontaine @jacmet
package/paho-mqtt-c: security bump to version 1.3.9
0f35d6d 
Old security issue not fixed:
eclipse/paho.mqtt.c#1084

https://github.com/eclipse/paho.mqtt.c/milestone/16?closed=1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9dad1ef)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
fix added
Projects
None yet
Milestone
1.3.9
Development

No branches or pull requests
2 participants
@tardyp @icraggs