Bin Yuan

**Name of the Vulnerable Software and Affected Versions** Eclipse Mosquitto versions 1.6 through 2.0.11 **Description** The issue is related to the implementation of the MQTT v5 protocol in Eclipse Mosquitto, which can cause excessive CPU usage. This can be exploited by a remote attacker to cause a denial of service. The problem occurs when an MQTT v5 client connects with a large number of `user-property` properties. **Recommendations** For Eclipse Mosquitto versions 1.6 through 2.0.11, consider restricting the number of `user-property` properties that can be sent by an MQTT v5 client to prevent excessive CPU usage. As a temporary workaround, restrict access to the MQTT v5 protocol until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions prior to 11.0.1 macOS Big Sur versions prior to 11.1 tvOS versions prior to 14.0 macOS Catalina versions prior to Security Update 2020-001 macOS Mojave versions prior to Security Update 2020-007 watchOS versions prior to 7.0 iOS versions prior to 14.0 iPadOS versions prior to 14.0 **Description** This issue was addressed with improved setting propagation. An attacker in a privileged network position may be able to unexpectedly alter application state. **Recommendations** For macOS Big Sur versions prior to 11.0.1, update to macOS Big Sur 11.0.1 or later. For macOS Big Sur versions prior to 11.1, update to macOS Big Sur 11.1 or later. For tvOS versions prior to 14.0, update to tvOS 14.0 or later. For macOS Catalina versions prior to Security Update 2020-001, apply Security Update 2020-001 or later. For macOS Mojave versions prior to Security Update 2020-007, apply Security Update 2020-007 or later. For watchOS versions prior to 7.0, update to watchOS 7.0 or later. For iOS versions prior to 14.0, update to iOS 14.0 or later. For iPadOS versions prior to 14.0, update to iPadOS 14.0 or later.