CVE catalog

CVE-2018-12550

mosquitto: CVE-2018-12550

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.35% · Oct 25, 2026

When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty ACL file mean that all access is denied, which is not a useful configuration but is not unexpected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmosquittosid2.1.2-3fixed
Debianmosquittoforky2.1.2-3fixed
Debianmosquittotrixie2.0.21-1fixed
Debianmosquittobookworm2.0.11-1.2+deb12u2fixed
Debianmosquittobookworm-security2.0.11-1.2+deb12u1fixed
Alpinemosquitto3.101.5.6-r0fixed
Alpinemosquitto3.111.5.6-r0fixed
Alpinemosquitto3.121.5.6-r0fixed
Alpinemosquitto3.131.5.6-r0fixed
Alpinemosquitto3.141.5.6-r0fixed
Alpinemosquitto3.151.5.6-r0fixed
Alpinemosquitto3.161.5.6-r0fixed
Alpinemosquitto3.171.5.6-r0fixed
Alpinemosquitto3.181.5.6-r0fixed
Alpinemosquitto3.191.5.6-r0fixed
Alpinemosquitto3.201.5.6-r0fixed
Alpinemosquitto3.211.5.6-r0fixed
Alpinemosquitto3.221.5.6-r0fixed
Alpinemosquitto3.231.5.6-r0fixed
Alpinemosquitto3.241.5.6-r0fixed
Alpinemosquitto3.71.4.15-r1fixed
Alpinemosquitto3.81.4.15-r4fixed
Alpinemosquitto3.91.5.6-r0fixed
Ubuntumosquittopro0.15-2ubuntu1vulnerable
Ubuntumosquittopro0.15-2ubuntu1.1vulnerable
Ubuntumosquittopro0.15-2ubuntu1.2vulnerable
Ubuntumosquittopro0.15-2+deb7u3ubuntu0.1vulnerable
Ubuntumosquittopro0.15-2+deb7u3ubuntu0.1+esm1vulnerable
Ubuntumosquitto16.041.4.3-1vulnerable
Ubuntumosquitto16.041.4.4-1vulnerable
Ubuntumosquitto16.041.4.7-1vulnerable
Ubuntumosquitto16.041.4.8-1vulnerable
Ubuntumosquitto16.041.4.8-1build1vulnerable
Ubuntumosquitto16.041.4.8-1ubuntu0.16.04.1vulnerable
Ubuntumosquitto16.041.4.8-1ubuntu0.16.04.2vulnerable
Ubuntumosquitto16.041.4.8-1ubuntu0.16.04.3vulnerable
Ubuntumosquitto16.041.4.8-1ubuntu0.16.04.4vulnerable
Ubuntumosquitto16.041.4.8-1ubuntu0.16.04.5fixed
Ubuntumosquitto18.041.4.12-1vulnerable
Ubuntumosquitto18.041.4.14-1vulnerable
Ubuntumosquitto18.041.4.14-2vulnerable
Ubuntumosquitto18.041.4.14-2build1vulnerable
Ubuntumosquitto18.041.4.15-1vulnerable
Ubuntumosquitto18.041.4.15-2vulnerable
Ubuntumosquitto18.041.4.15-2ubuntu0.18.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmosquittosourcesid1.5.6-1not yet assignedNot reported[921976]
Debianmosquittosourceforky1.5.6-1not yet assignedNot reported[921976]
Debianmosquittosourcetrixie1.5.6-1not yet assignedNot reported[921976]
Debianmosquittosourcebookworm1.5.6-1not yet assignedNot reported[921976]
Alpinemosquittoapk3.101.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.111.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.121.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.131.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.141.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.151.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.161.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.171.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.181.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.191.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.201.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.211.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.221.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.231.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.241.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.71.4.15-r1Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.81.4.15-r4Not reportedALPINE-CVE-2018-12550Not reported
Alpinemosquittoapk3.91.5.6-r0Not reportedALPINE-CVE-2018-12550Not reported
Ubuntumosquittodeb16.041.4.8-1ubuntu0.16.04.5Not reportedUBUNTU-CVE-2018-12550Not reported
Ubuntumosquittodeb18.041.4.15-2ubuntu0.18.04.1Not reportedUBUNTU-CVE-2018-12550Not reported

[Debian bug #921976]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmosquitto1]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [libmosquitto-dev]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [libmosquittopp1]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [libmosquittopp-dev]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [mosquitto]Fixed
    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [mosquitto-clients]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [mosquitto-dev]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · all · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · all · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · all · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · all · bookworm-security

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

[Debian 13 (Trixie)]

  • [libmosquitto1]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

  • [libmosquitto-dev]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

  • [libmosquittopp1]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

  • [libmosquittopp-dev]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

  • [mosquitto]Fixed
    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

  • [mosquitto-clients]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

  • [mosquitto-dev]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · all · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · all · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · mosquitto · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]