CVE-2018-20145: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 7.5
Published: 2018-12-13T20:29Z
Repository: https://github.com/eclipse/mosquitto
Language: C
Files changed: ChangeLog.txt, src/conf.c
Commit date: 2018-12-09 21:23:46 +0000
Commit message: Fix acl_file being ignore for default listener if with per_listener_settings

Close #1073. Thanks to Jef Driesen.

Bug: https://github.com/eclipse/mosquitto/issues/1073

Diff: diff --git a/ChangeLog.txt b/ChangeLog.txt
index c3a6c60..6287bce 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -1,8 +1,13 @@
 1.5.5 - 201812xx
 ================
 
+Security:
+- If `per_listener_settings` is set to true, then the `acl_file` setting was
+  ignored for the "default listener" only. This has been fixed. This does not
+  affect any listeners defined with the `listener` option. Closes #1073.
+
 Broker:
 - Add `socket_domain` option to allow listeners to disable IPv6 support.
   This is required to work around a problem in libwebsockets that means
   sockets only listen on IPv6 by default if IPv6 support is compiled in.
   Closes #1004.
diff --git a/src/conf.c b/src/conf.c
index 67e172b..8729468 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -495,10 +495,11 @@ int config__parse_args(struct mosquitto_db *db, struct mosquitto__config *config
 		config->listeners[config->listener_count-1].ssl_ctx = NULL;
 		config->listeners[config->listener_count-1].crlfile = config->default_listener.crlfile;
 		config->listeners[config->listener_count-1].use_identity_as_username = config->default_listener.use_identity_as_username;
 		config->listeners[config->listener_count-1].use_subject_as_username = config->default_listener.use_subject_as_username;
 #endif
+		config->listeners[config->listener_count-1].security_options.acl_file = config->default_listener.security_options.acl_file;
 		config->listeners[config->listener_count-1].security_options.password_file = config->default_listener.security_options.password_file;
 		config->listeners[config->listener_count-1].security_options.psk_file = config->default_listener.security_options.psk_file;
 		config->listeners[config->listener_count-1].security_options.auth_plugin_configs = config->default_listener.security_options.auth_plugin_configs;
 		config->listeners[config->listener_count-1].security_options.auth_plugin_config_count = config->default_listener.security_options.auth_plugin_config_count;
 		config->listeners[config->listener_count-1].security_options.allow_anonymous = config->default_listener.security_options.allow_anonymous;

Fixed code: Security:
- If `per_listener_settings` is set to true, then the `acl_file` setting was
  ignored for the "default listener" only. This has been fixed. This does not
  affect any listeners defined with the `listener` option. Closes #1073.

		config->listeners[config->listener_count-1].security_options.acl_file = config->default_listener.security_options.acl_file;