[mosquitto-dev] How to address CVE-2023-28366 in older versions of mosqu

[Markus Koschany <apo@xxxxxxxxxx>]

Hi all,

@Roger

Thanks for your help and for pointing out the fixing commits for the recent
CVE. I believe I have addressed them in Debian stable and oldstable already.
Now I am looking to fix Debian Buster as well which ships mosquitto 1.5.7.

Apparently 1.5.7 is affected by CVE-2023-28366 but the code base is quite
different. Is there a less intrusive way to address this problem? Is there a
sensible workaround available or should I just ignore the issue? Another
possible idea is to backport 2.0.11 from Debian oldstable. What would you
recommend as the maintainer of mosquitto in Debian?

Regards,

Markus

Attachment: signature.asc
Description: This is a digitally signed message part