Yan Jia

**Name of the Vulnerable Software and Affected Versions** Eclipse Mosquitto versions 1.6 through 2.0.11 **Description** The issue is related to the implementation of the MQTT v5 protocol in Eclipse Mosquitto, which can cause excessive CPU usage. This can be exploited by a remote attacker to cause a denial of service. The problem occurs when an MQTT v5 client connects with a large number of `user-property` properties. **Recommendations** For Eclipse Mosquitto versions 1.6 through 2.0.11, consider restricting the number of `user-property` properties that can be sent by an MQTT v5 client to prevent excessive CPU usage. As a temporary workaround, restrict access to the MQTT v5 protocol until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions prior to 11.0.1 macOS Big Sur versions prior to 11.1 tvOS versions prior to 14.0 macOS Catalina versions prior to Security Update 2020-001 macOS Mojave versions prior to Security Update 2020-007 watchOS versions prior to 7.0 iOS versions prior to 14.0 iPadOS versions prior to 14.0 **Description** This issue was addressed with improved setting propagation. An attacker in a privileged network position may be able to unexpectedly alter application state. **Recommendations** For macOS Big Sur versions prior to 11.0.1, update to macOS Big Sur 11.0.1 or later. For macOS Big Sur versions prior to 11.1, update to macOS Big Sur 11.1 or later. For tvOS versions prior to 14.0, update to tvOS 14.0 or later. For macOS Catalina versions prior to Security Update 2020-001, apply Security Update 2020-001 or later. For macOS Mojave versions prior to Security Update 2020-007, apply Security Update 2020-007 or later. For watchOS versions prior to 7.0, update to watchOS 7.0 or later. For iOS versions prior to 14.0, update to iOS 14.0 or later. For iPadOS versions prior to 14.0, update to iPadOS 14.0 or later.

**Name of the Vulnerable Software and Affected Versions** Eclipse Mosquitto versions 1.0 through 1.5.5 **Description** The issue is related to insufficient access control in the Eclipse Mosquitto message broker. It may allow a remote attacker to gain unauthorized access to protected information. In certain applications, this could result in clients being able to cause effects that would otherwise not be allowed, such as publishing retained messages to topics they no longer have access to. **Recommendations** For Eclipse Mosquitto versions 1.0 through 1.5.5, consider restricting access to topics and implementing proper access control mechanisms to prevent unauthorized message publication. As a temporary workaround, consider disabling the publication of retained messages to sensitive topics until a patch is available.

Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 1.0 through 1.5.5 Description: The issue is related to the configuration of the access control list (ACL) file in Eclipse Mosquitto. When the ACL file is empty or contains only comments or blank lines, Mosquitto previously used a default allow policy. However, the new behavior is to deny all access if the ACL file is empty. This change in behavior may lead to unexpected configuration issues. The vulnerability is also related to insufficient input validation and incorrect implementation of functions, which may allow a remote attacker to gain unauthorized access to protected information. Recommendations: For Eclipse Mosquitto versions 1.0 through 1.5.5, ensure that the ACL file is properly configured and not empty to avoid denying all access. As a temporary workaround, consider defining a default ACL policy to minimize the risk of exploitation. Restrict access to the broker until a proper ACL configuration is in place.