CVE-2024-3935

Name	CVE-2024-3935
Description	In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mosquitto (PTS)	jessie, jessie (lts)	1.3.4-2+deb8u4	vulnerable
	stretch (security), stretch (lts), stretch	1.4.10-3+deb9u5	vulnerable
	buster (security), buster, buster (lts)	1.5.7-1+deb10u1	vulnerable
	bullseye (security), bullseye	2.0.11-1+deb11u1	vulnerable
	bookworm (security), bookworm	2.0.11-1.2+deb12u1	vulnerable
	sid, trixie	2.0.20-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mosquitto	source	(unstable)	2.0.20-1

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197
https://mosquitto.org/blog/2024/10/version-2-0-19-released/