CVE-2024-3935

Name	CVE-2024-3935
Description	In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4059-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mosquitto (PTS)	bullseye	2.0.11-1+deb11u1	vulnerable
	bullseye (security)	2.0.11-1+deb11u2	fixed
	bookworm, bookworm (security)	2.0.11-1.2+deb12u1	vulnerable
	sid, trixie	2.0.20-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mosquitto	source	bullseye	2.0.11-1+deb11u2		DLA-4059-1
mosquitto	source	(unstable)	2.0.20-1

Notes

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197
https://mosquitto.org/blog/2024/10/version-2-0-19-released/
https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9 (v2.0.19)