- Update to 1.4.13
* Security:
- Fix CVE-2017-9868. The persistence file was readable
by all local users, potentially allowing sensitive
information to be leaked.
This can also be fixed administratively, by restricting
access to the directory in which the persistence file
is stored.
* Broker:
- Fix for poor websockets performance.
- Fix lazy bridges not timing out for idle_timeout.
- Fix problems with large retained messages over websockets.
- Set persistence file to only be readable by owner,
except on Windows.
- Fix CONNECT check for reserved=0, as per MQTT v3.1.1
check MQTT-3.1.2-3.
- When the broker stop, wills for any connected clients
are now "sent".
- Auth plugins can be configured to disable the check for +# in
usernames/client ids with the auth_plugin_deny_special_chars
option. Partially closes#462.
- Restrictions for CVE-2017-7650 have been relaxed - '/' is
allowed in usernames/client ids. Remainder of fix for #462.
Clients:
- Don't use / in auto-generated client ids.
OBS-URL: https://build.opensuse.org/request/show/508416
OBS-URL: https://build.opensuse.org/package/show/network:messaging:mqtt/mosquitto?expand=0&rev=2
