9f1ca943d5
Fixes the following security issues: - CVE-2023-28366: Fix memory leak in broker when clients send multiple QoS 2 messages with the same message ID, but then never respond to the PUBREC commands. - CVE-2023-0809: Fix excessive memory being allocated based on malicious initial packets that are not CONNECT packets. - CVE-2023-3592: Fix memory leak when clients send v5 CONNECT packets with a will message that contains invalid property types. - Broker will now reject Will messages that attempt to publish to $CONTROL/. - Broker now validates usernames provided in a TLS certificate or TLS-PSK identity are valid UTF-8. - Fix potential crash when loading invalid persistence file. - Library will no longer allow single level wildcard certificates, e.g. *.com For more details, see the changelog: https://mosquitto.org/ChangeLog.txt Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
9 lines
485 B
Plaintext
9 lines
485 B
Plaintext
# Locally calculated after checking gpg signature
|
|
# from https://mosquitto.org/files/source/mosquitto-2.0.16.tar.gz.asc
|
|
sha256 638db9e43e89d243ea98d10d66e76ff376131217780decd01abaffacc66d8035 mosquitto-2.0.16.tar.gz
|
|
|
|
# License files
|
|
sha256 d3c4ccace4e5d3cc89d34cf2a0bc85b8596bfc0a32b815d0d77f9b7c41b5350c LICENSE.txt
|
|
sha256 8c349f80764d0648e645f41ef23772a70c995a0924b5235f735f4a3d09df127c epl-v20
|
|
sha256 86fc4a3f97cb769c04e8da557036c1066eb8bb22b2d0a5dd31464990fe84047c edl-v10
|