← Voltar para CVEs

CVE-2020-15166

HIGH

7.5

Descricao

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado9/11/2020

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

debian:debian_linuxfedoraproject:fedorazeromq:libzmq

Fraquezas (CWE)

CWE-400

Referencias

https://github.com/zeromq/libzmq/pull/3913(security-advisories@github.com)

https://github.com/zeromq/libzmq/pull/3973(security-advisories@github.com)

https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m(security-advisories@github.com)

https://lists.debian.org/debian-lts-announce/2020/11/msg00017.html(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ5IMNQXDB52JFBXHFLK4AHVORFELNNG/(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFW2ZELCCPS4VLU4OSJOH5YL6KFKTFYW/(security-advisories@github.com)

https://security.gentoo.org/glsa/202009-12(security-advisories@github.com)

https://github.com/zeromq/libzmq/pull/3913(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/zeromq/libzmq/pull/3973(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2020/11/msg00017.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ5IMNQXDB52JFBXHFLK4AHVORFELNNG/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFW2ZELCCPS4VLU4OSJOH5YL6KFKTFYW/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202009-12(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.