In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "libmosquitto0", "binary_version": "0.15-2ubuntu1.1" }, { "binary_name": "libmosquitto0-dev", "binary_version": "0.15-2ubuntu1.1" }, { "binary_name": "libmosquittopp0", "binary_version": "0.15-2ubuntu1.1" }, { "binary_name": "libmosquittopp0-dev", "binary_version": "0.15-2ubuntu1.1" }, { "binary_name": "mosquitto", "binary_version": "0.15-2ubuntu1.1" }, { "binary_name": "mosquitto-clients", "binary_version": "0.15-2ubuntu1.1" }, { "binary_name": "python-mosquitto", "binary_version": "0.15-2ubuntu1.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "libmosquitto-dev", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquitto-dev-dbgsym", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquitto1", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquitto1-dbg", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquitto1-dbgsym", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquittopp-dev", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquittopp-dev-dbgsym", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquittopp1", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquittopp1-dbg", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "libmosquittopp1-dbgsym", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "mosquitto", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "mosquitto-clients", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "mosquitto-clients-dbgsym", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "mosquitto-dbg", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "mosquitto-dbgsym", "binary_version": "1.4.8-1ubuntu0.16.04.1" }, { "binary_name": "mosquitto-dev", "binary_version": "1.4.8-1ubuntu0.16.04.1" } ] }