| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: libmosquitto1 | Distribution: openSUSE Tumbleweed |
| Version: 2.0.18 | Vendor: openSUSE |
| Release: 3.1 | Build date: Thu Mar 21 13:20:58 2024 |
| Group: Development/Libraries/C and C++ | Build host: reproducible |
| Size: 111566 | Source RPM: mosquitto-2.0.18-3.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://mosquitto.org/ | |
| Summary: Shared C Library for mosquitto | |
Mosquitto is a message broker that implements the MQ Telemetry Transport protocol versions 3.1 and 3.1.1. MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This package holds the shared C library.
EPL-1.0
* Thu Mar 21 2024 Dirk Stoecker <opensuse@dstoecker.de>
- Add Reload action to service
* Sat Feb 03 2024 Arjen de Korte <suse+build@de-korte.org>
- Use sysuser-tools to generate mosquitto user
* Sat Dec 30 2023 Dirk Müller <dmueller@suse.com>
- update to 2.0.18 (bsc#1214918, CVE-2023-28366, bsc#1215865,
CVE-2023-0809, bsc#1215864, CVE-2023-3592):
* Fix crash on subscribe under certain unlikely conditions.
* Fix mosquitto_rr not honouring `-R`. Closes #2893.
* Fix `max_queued_messages 0` stopping clients from receiving
messages.
* Fix `max_inflight_messages` not being set correctly.
* Fix `mosquitto_passwd -U` backup file creation.
* CVE-2023-28366: Fix memory leak in broker when clients send
multiple QoS 2 messages with the same message ID, but then
never respond to the PUBREC commands.
* CVE-2023-0809: Fix excessive memory being allocated based on
malicious initial packets that are not CONNECT packets.
* CVE-2023-3592: Fix memory leak when clients send v5 CONNECT
packets with a will message that contains invalid property
types.
* Broker will now reject Will messages that attempt to publish
to $CONTROL/.
* Broker now validates usernames provided in a TLS certificate
or TLS-PSK identity are valid UTF-8.
* Fix potential crash when loading invalid persistence file.
* Library will no longer allow single level wildcard
certificates, e.g. *.com
* Fix $SYS messages being expired after 60 seconds and hence
unchanged values disappearing.
* Fix some retained topic memory not being cleared immediately
after used.
* Fix error handling related to the `bind_interface` option.
* Fix std* files not being redirected when daemonising, when
built with assertions removed.
* Fix default settings incorrectly allowing TLS v1.1.
* Use line buffered mode for stdout.
* Fix bridges with non-matching cleansession/local_cleansession
being expired on start after restoring from persistence
* Fix connections being limited to 2048 on Windows. The limit
is now 8192, where supported.
* Broker will log warnings if sensitive files are world
readable/writable, or if the owner/group is not the same as
the user/group the broker is running as. In future versions
the broker will refuse to open these files.
* mosquitto_memcmp_const is now more constant time.
* Only register with DLT if DLT logging is enabled.
* Fix any possible case where a json string might be
incorrectly loaded. This could have caused a crash if a
textname or textdescription field of a role was not a string,
when loading the dynsec config from file only.
* Dynsec plugin will not allow duplicate clients/groups/roles
when loading config from file, which matches the behaviour
for when creating them.
* Fix heap overflow when reading corrupt config with "log_dest
file".
* Use CLOCK_BOOTTIME when available, to keep track of time.
This solves the problem of the client OS sleeping and the
client hence not being able to calculate the actual time for
keepalive purposes.
* Fix default settings incorrectly allowing TLS v1.1. Closes
* Fix high CPU use on slow TLS connect.
* Fix incorrect topic-alias property value in mosquitto_sub
json output.
* Fix confusing message on TLS certificate verification.
* mosquitto_passwd uses mkstemp() for backup files.
* `mosquitto_ctrl dynsec init` will refuse to overwrite an
existing file, without a race-condition.
* Mon Aug 22 2022 Dirk Müller <dmueller@suse.com>
- update to 2.0.15:
* Deleting the group configured as the anonymous group in the Dynamic Security
plugin, would leave a dangling pointer that could lead to a single crash.
This is considered a minor issue - only administrative users should have
access to dynsec, the impact on availability is one-off, and there is no
associated loss of data. It is now forbidden to delete the group configured
as the anonymous group.
* Fix memory leak when a plugin modifies the topic of a message in
MOSQ_EVT_MESSAGE.
* Fix bridge `restart_timeout` not being honoured.
* Fix potential memory leaks if a plugin modifies the message in the
MOSQ_EVT_MESSAGE event.
* Fix unused flags in CONNECT command being forced to be 0, which is not
required for MQTT v3.1. Closes #2522.
* Improve documentation of `persistent_client_expiration` option.
Closes #2404.
* Add clients to session expiry check list when restarting and reloading from
persistence. Closes #2546.
* Fix bridges not sending failure notification messages to the local broker if
the remote bridge connection fails. Closes #2467. Closes #1488.
* Fix some PUBLISH messages not being counted in $SYS stats. Closes #2448.
* Fix incorrect return code being sent in DISCONNECT when a client session is
taken over. Closes #2607.
* Fix confusing "out of memory" error when a client is kicked in the dynamic
security plugin. Closes #2525.
* Fix confusing error message when dynamic security config file was a
directory. Closes #2520.
* Fix bridge queued messages not being persisted when local_cleansession is
set to false and cleansession is set to true. Closes #2604.
* Dynamic security: Fix modifyClient and modifyGroup commands to not modify
the client/group if a new group/client being added is not valid.
* Dynamic security: Fix the plugin being able to be loaded twice. Currently
only a single plugin can interact with a unique $CONTROL topic. Using
multiple instances of the plugin would produce duplicate entries in the
config file. Closes #2601. Closes #2470.
* Fix case where expired messages were causing queued messages not to be
delivered. Closes #2609.
* Fix websockets not passing on the X-Forwarded-For header.
* Fix use of `MOSQ_OPT_TLS_ENGINE` being unable to be used due to the openssl
ctx not being initialised until starting to connect. Closes #2537.
* Fix incorrect use of SSL_connect. Closes #2594.
* Don't set SIGPIPE to ignore, use MSG_NOSIGNAL instead. Closes #2564.
* Add documentation of struct mosquitto_message to header. Closes #2561.
* Fix documentation omission around mosquitto_reinitialise. Closes #2489.
* Fix use of MOSQ_OPT_SSL_CTX when used in conjunction with
MOSQ_OPT_SSL_CTX_DEFAULTS. Closes #2463.
* Fix failure to close thread in some situations. Closes #2545.
* Fix mosquitto_pub incorrectly reusing topic aliases when reconnecting.
* Fix `-o` not working in `mosquitto_ctrl`, and typo in related documentation.
* Thu Nov 18 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.14
Broker:
* Fix bridge not respecting receive-maximum when reconnecting
with MQTT v5.
Client library:
* Fix mosquitto_topic_matches_sub2() not using the length
parameters.
* Fix incorrect subscribe_callback in mosquittopp.h.
* Thu Oct 28 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.13
Broker:
* Fix `max_keepalive` option not being able to be set to 0.
* Fix LWT messages not being delivered if `per_listener_settings`
was set to true.
* Various fixes around inflight quota management.
* Fix problem parsing config files with Windows line endings.
* Don't send retained messages when a shared subscription is made
* Fix client id not showing in log on failed connections, where
possible.
* Fix broker sending duplicate CONNACK on failed MQTT v5
reauthentication.
* Fix mosquitto_plugin.h not including mosquitto_broker.h.
Client library:
* Initialise sockpairR/W to invalid in `mosquitto_reinitialise()`
to avoid closing invalid sockets in `mosquitto_destroy()` on
error.
Clients:
- Fix date format in mosquitto_sub output.
* Wed Oct 06 2021 Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s) (bsc#1181400). Modified:
* mosquitto.service
* Wed Sep 01 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.12
* Includes security fixes for
CVE-2021-34434 (bsc#1190048) and CVE-2020-13849 (bsc#1190101)
Security :
* An MQTT v5 client connecting with a large number of
user-property properties could cause excessive CPU usage,
leading to a loss of performance and possible denial of
service. This has been fixed.
* Fix `max_keepalive` not applying to MQTT v3.1.1 and v3.1
connections. These clients are now rejected if their keepalive
value exceeds max_keepalive. This option allows CVE-2020-13849,
which is for the MQTT v3.1.1 protocol itself rather than an
implementation, to be addressed.
* Using certain listener related configuration options e.g.
`cafile`, that apply to the default listener without defining
any listener would cause a remotely accessible listener to be
opened that was not confined to the local machine but did have
anonymous access enabled, contrary to the documentation.
This has been fixed. Closes #2283.
* CVE-2021-34434: If a plugin had granted ACL subscription access
to a durable/non-clean-session client, then removed that
access,the client would keep its existing subscription. This
has been fixed.
* Incoming QoS 2 messages that had not completed the QoS flow
were not being checked for ACL access when a clean
session=False client was reconnecting. This has been fixed.
Broker:
* Fix possible out of bounds memory reads when reading a
corrupt/crafted configuration file. Unless your configuration
file is writable by untrusted users this is not a risk.
* Fix `max_connections` option not being correctly counted.
* Fix TLS certificates and TLS-PSK not being able to be
configured at the same time.
* Disable TLS v1.3 when using TLS-PSK, because it isn't correctly
configured.
* Fix `max_keepalive` not applying to MQTT v3.1.1 and v3.1
connections. These clients are now rejected if their keepalive
value exceeds max_keepalive.
* Fix broker not quiting if e.g. the `password_file` is specified
as a directory. Closes #2241.
* Fix listener mount_point not being removed on outgoing messages.
* Strict protocol compliance fixes, plus test suite.
* Fix $share subscriptions not being recovered for durable
clients that reconnect.
* Update plugin configuration documentation. Closes #2286.
Client library:
* If a client uses TLS-PSK then force the default cipher list to
use "PSK" ciphers only. This means that a client connecting to
a broker configured with x509 certificates only will now fail.
Prior to this, the client would connect successfully without#
verifying certificates, because they were not configured.
* Disable TLS v1.3 when using TLS-PSK, because it isn't correctly
configured.
* Threaded mode is deconfigured when the mosquitto_loop_start()
thread ends, which allows mosquitto_loop_start() to be called
again.
* Fix MOSQ_OPT_SSL_CTX not being able to be set to NULL.
* Fix reconnecting failing when MOSQ_OPT_TLS_USE_OS_CERTS was in
use, but none of capath, cafile, psk, nor MOSQ_OPT_SSL_CTX were
set, and MOSQ_OPT_SSL_CTX_WITH_DEFAULTS was set to the default
value of true.
Apps:
* Fix `mosquitto_ctrl dynsec setDefaultACLAccess` command not
working.
Clients:
* Document TLS certificate behaviour when using `-p 8883`.
Build:
* Fix installation using WITH_TLS=no. Closes #2281.
* Fix builds with libressl 3.4.0. Closes #2198.
* Remove some unnecessary code guards related to libressl.
* Fix printf format build warning on MIPS. Closes #2271.
* Wed Jun 09 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.11
Security:
* If a MQTT v5 client connects with a crafted CONNECT packet a
memory leak will occur. This has been fixed.
Broker:
* Fix possible crash having just upgraded from 1.6 if
`per_listener_settings true` is set, and a SIGHUP is sent to
the broker before a client has reconnected to the broker.
* Fix bridge not reconnectng if the first reconnection attempt
fails.
* Improve QoS 0 outgoing packet queueing.
* Fix QoS 0 messages not being queued when `queue_qos0_messages`
was enabled.
Clients:
* If sending mosquitto_sub output to a pipe, mosquitto_sub will
now detect that the pipe has closed and disconnect.
* Fix `mosquitto_pub -l` quitting if a message publication is
attempted when the broker is temporarily unavailable.
- Remove not longer needed patch:
* fix-undefined-symbols-in-plugins.patch (fixed upstream)
* Tue Apr 06 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.10
Security:
* CVE-2021-28166: If an authenticated client connected with
MQTT v5 sent a malformed CONNACK message to the broker a NULL
pointer dereference occurred, most likely resulting in a
segfault. This will be updated with the CVE number when it is
assigned.
Affects versions 2.0.0 to 2.0.9 inclusive.
Broker:
* Don't over write new receive-maximum if a v5 client connects
and takes over an old session.
* Fix CVE-2021-28166. Closes #2163.
Clients:
* Set `receive-maximum` to not exceed the `-C` message count in
mosquitto_sub and mosquitto_rr, to avoid potentially lost
messages.
* Fix TLS-PSK mode not working with port 8883.
Client library:
* Fix possible socket leak. This would occur if a client was
using `mosquitto_loop_start()`, then if the connection failed
due to the remote server being inaccessible they called
`mosquitto_loop_stop(, true)` and recreated the mosquitto
object.
Build:
* A variety of minor build related fixes, like functions not
having previous declarations.
* Fri Mar 12 2021 Martin Hauke <mardnh@gmx.de>
- Build with support for tcp-wrapper (-DUSE_LIBWRAP=ON)
- Update to version 2.0.9
Security:
* If an empty or invalid CA file was provided to the client
library for verifying the remote broker, then the initialx
connection would fail but subsequent connections would succeed
without verifying the remote broker certificate.
* If an empty or invalid CA file was provided to the broker for
verifying the remote broker for an outgoing bridge connection
then the initial connection would fail but subsequent
connections would succeed without verifying the
remote broker certificate.
Broker:
* Fix encrypted bridge connections incorrectly connecting when
`bridge_cafile` is empty or invalid.
* Fix `tls_version` behaviour not matching documentation. It was
setting the exact TLS version to use, not the minimium TLS
version to use.
* Fix messages to `$` prefixed topics being rejected.
* Fix QoS 0 messages not being delivered when max_queued_bytes
was configured.
* Fix bridge increasing backoff calculation.
* Improve handling of invalid combinations of listener address
and bind interface configurations.
* Fix `max_keepalive` option not applying to clients connecting
with keepalive set to 0.
Client library:
* Fix encrypted connections incorrectly connecting when the CA
file passed to `mosquitto_tls_set()` is empty or invalid.
* Fix connections retrying very rapidly in some situations.
Build:
* Fix cmake epoll detection.
* Thu Mar 11 2021 Marcus Rueckert <mrueckert@suse.de>
- Convert some of the BuildRequires from package names to
pkgconfig(): libcares, libcjson, libwebsockets
* Thu Mar 11 2021 Marcus Rueckert <mrueckert@suse.de>
- Fix linking of modules:
- Add fix-undefined-symbols-in-plugins.patch
- revert old workaround of settings -DCMAKE_SHARED_LINKER_FLAGS=
* Thu Mar 11 2021 Marcus Rueckert <mrueckert@suse.de>
- Update mosquitto-1.6.8-config.patch:
Set a short profilename for a cleaner ps aufxZ output
- Refreshed mosquitto-1.6.8-config.patch to apply cleanly again
* Sun Feb 28 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.8
Broker:
* Fix incorrect datatypes in `struct mosquitto_evt_tick`. This
changes the size and offset of two of the members of this
struct, and changes the size of the struct. This is an ABI
break, but is considered to be acceptable because plugins
should never be allocating their own instance of this struct,
and currently none of the struct members are used for anything,
so a plugin should not be accessing them. It would also be
safe to read/write from the existing struct parameters.
* Give compile time warning if libwebsockets compiled without
external poll support.
Client library:
* Fix mosquitto_{pub|sub}_topic_check() functions not returning
MOSQ_ERR_INVAL on topic == NULL.
Clients:
* Fix possible loss of data in `mosquitto_pub -l` when sending
multiple long lines.
* Sat Feb 06 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.7
Broker:
* Fix some minor memory leaks on exit only.
* Fix possible memory leak on connect.
* Fix openssl engine not being able to load private key.
Clients:
* Fix config files truncating options after the first space.
Build:
- Fix man page building to not absolutely require xsltproc when
using CMake.
- Update to version 2.0.6
Broker:
* Fix calculation of remaining length parameter for websockets
clients that send fragmented packets.
Broker:
* Fix potential duplicate Will messages being sent when a will
delay interval has been set.
* Fix message expiry interval property not being honoured in
`mosquitto_broker_publish` and `mosquitto_broker_publish_copy`.
* Fix websockets listeners with TLS not responding.
* Improve logging in obscure cases when a client disconnects.
* Fix reloading of listeners where multiple listeners have been
defined with the same port but different bind addresses.
* Fix `message_size_limit` not applying to the Will payload.
* The error topic-alias-invalid was being sent if an MQTT v5
client published a message with empty topic and topic alias
set, but the topic alias hadn't already been configured on
the broker. This has been fixed to send a protocol error, as
per section 3.3.4 of the specification.
* Note in the man pages that SIGHUP reloads TLS certificates.
Apps:
* Allow command line arguments to override config file options in
mosquitto_ctrl.
* mosquitto_ctrl: produce an error when requesting a new password
if both attempts do not match.
* Tue Jan 12 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.5
Broker:
* Fix "auth_method" not being provided to the extended auth
plugin event.
* Fix large packets not being completely published to slow
clients.
* Fix bridge connection not relinquishing POLLOUT after messages
are sent.
* Fix apparmor incorrectly denying access to
/var/lib/mosquitto/mosquitto.db.new.
* Fix potential intermittent initial bridge connections when
using poll().
* Fix "bind_interface" option.
* Fix invalid behaviour in dynsec plugin if a group or client is
deleted before a role that was attached to the group or client
is deleted.
* Improve logging in dynsec addGroupRole/addGroupClient commands.
Client library:
* Improve documentation around the "_v5()" and non-v5 functions,
e.g. `mosquitto_publish()` and `mosquitto_publish_v5().
Build:
* "install" Makefile target should depend on "all", not
"mosquitto", to ensure that man pages are always built.
Apps:
* Disallow control characters in mosquitto_passwd usernames.
* Fix incorrect description in mosquitto_ctrl man page.
* Fix `mosquitto_ctrl dynsec getGroup` not showing roles.
/usr/lib/libmosquitto.so.1 /usr/lib/libmosquitto.so.2.0.18 /usr/share/licenses/libmosquitto1 /usr/share/licenses/libmosquitto1/LICENSE.txt /usr/share/licenses/libmosquitto1/edl-v10 /usr/share/licenses/libmosquitto1/epl-v20
Generated by rpm2html 1.8.1
Fabrice Bellet, Sat Apr 27 00:22:44 2024