Hi Thorsten I have not seen an email about that this package has been accepted by the FTP archieve, neither can I find the fixed version in the archives. Can you please check what went wrong?
In addition I think something have went wrong in the security tracker database because the two CVEs are listed as unfixed. Can you check that as well? > ola@tigereye:~/git/security-tracker$ bin/lts-cve-triage.py > --skip-dla-needed --exclude undetermined > Updating ~/.cache/debian_security_tracker.json from > https://security-tracker.debian.org/tracker/data/json ... > Updating /home/ola/.cache/security-support-ended.deb7 from > https://salsa.debian.org/debian/debian-security-support/raw/master/security-support-ended.deb7 > ... > Updating /home/ola/.cache/security-support-limited from > https://salsa.debian.org/debian/debian-security-support/raw/master/security-support-limited > ... > Other issues to triage for wheezy (not yet triaged for jessie): > * mosquitto > https://security-tracker.debian.org/tracker/source-package/mosquitto > - CVE-2017-7651 > https://security-tracker.debian.org/tracker/CVE-2017-7651 > - CVE-2017-7652 > https://security-tracker.debian.org/tracker/CVE-2017-7652 Thanks in advance // Ola On 31 March 2018 at 20:24, Thorsten Alteholz <deb...@alteholz.de> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > Package : mosquitto > Version : 0.15-2+deb7u3 > CVE ID : CVE-2017-7651 CVE-2017-7652 > > > CVE-2017-7651 > A crafted CONNECT packet from an unauthenticated client could > result in extraordinary memory consumption. > > CVE-2017-7652 > In case all sockets/file descriptors are exhausted, a SIGHUP > signal to reload the configuration could result in default > config values (especially bad security settings) > > > For Debian 7 "Wheezy", these problems have been fixed in version > 0.15-2+deb7u3. > > We recommend that you upgrade your mosquitto packages. > > Further information about Debian LTS security advisories, how to apply > these updates to your system and frequently asked questions can be > found at: https://wiki.debian.org/LTS > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.12 (GNU/Linux) > > iQJ8BAEBCgBmBQJav9JTXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w > ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ2MjAxRkJGRkRCQkRFMDc4MjJFQUJCOTY5 > NkZDQUMwRDM4N0I1ODQ3AAoJEJb8rA04e1hHXJIQALUMNe9NaCPBKQaTJE3sKo2v > 1CIAzcoTwZJzUr/x8zM8Bnompi7kh5j2V4G4GjJyJ31LZheDxRH/k35t1Ba6PAtl > TkTRgO/PVoJKYHIfyUinNvqzsXFpAzld08w5sVlA7zzxmnm6Ppwwdpk6g2hSIoSG > 1Z5STvO6eJLiK8u6hXgkqyaY/4eKlfbTe+Fkd35LzoqJPEHNyLHDBsNQk8/VO1xn > 3aNjsU7kc07n/qofFKcWZrlSt6L8Q+ucmHeinwOKT8r/H7/DxXr3yqQqXJ/C+/n+ > cwjX5KTng5eEy27WmHv41oamaty4qmlM1uf/yX48th8FQdV6AV7uRK2Y+AKsat04 > VaZdTBk4AZKn8u7A9jypqoILhU97SJyVO1jvO5Cqe2lP4OrT9J86MWDs496ZtQEb > 4Qi6M76LueYoo7iggv67ATQKwXpARS3J8fMEo+0xBC+Oa76m016eotPkUdRpmmMC > 08BSzI2tuQG3i4gbbz96u5bhCyGauFcjnWsTHD97MgCGz9LfBywkrk4eippp/sIF > rJMsYNJMfiJfB2L7f2dZ+heinTjM1x4KfKf+LceZiNcHy6SNycUFD0YLs9ZxvK90 > /o5Diq8tjlCl6lxr4A3swvl3xxlpC+M9XuPgfWIsnWxKIQ6J+1Qmv4f6RVfNHAJc > cys3l3XIVUAWhqkkuvaF > =qQYi > -----END PGP SIGNATURE----- > > -- --- Inguza Technology AB --- MSc in Information Technology ---- / o...@inguza.com Folkebogatan 26 \ | o...@debian.org 654 68 KARLSTAD | | http://inguza.com/ Mobile: +46 (0)70-332 1551 | \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 / ---------------------------------------------------------------