Search

Find a vulnerability

Search criteria

    1 vulnerability by zeromq

    CVE-2020-15166 (GCVE-0-2020-15166)

    Vulnerability from cvelistv5 – Published: 2020-09-11 15:35 – Updated: 2024-08-04 13:08
    VLAI
    Title
    Denial of Service in ZeroMQ
    Summary
    In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Vendor Product Version
    zeromq libzmq Affected: < 4.3.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:22.367Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/zeromq/libzmq/pull/3913"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/zeromq/libzmq/pull/3973"
          },
          {
            "name": "GLSA-202009-12",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202009-12"
          },
          {
            "name": "FEDORA-2020-08402f4071",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ5IMNQXDB52JFBXHFLK4AHVORFELNNG/"
          },
          {
            "name": "FEDORA-2020-5460fcf6bd",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFW2ZELCCPS4VLU4OSJOH5YL6KFKTFYW/"
          },
          {
            "name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2443-1] zeromq3 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libzmq",
          "vendor": "zeromq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-10T16:06:15.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zeromq/libzmq/pull/3913"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zeromq/libzmq/pull/3973"
        },
        {
          "name": "GLSA-202009-12",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202009-12"
        },
        {
          "name": "FEDORA-2020-08402f4071",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ5IMNQXDB52JFBXHFLK4AHVORFELNNG/"
        },
        {
          "name": "FEDORA-2020-5460fcf6bd",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFW2ZELCCPS4VLU4OSJOH5YL6KFKTFYW/"
        },
        {
          "name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2443-1] zeromq3 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00017.html"
        }
      ],
      "source": {
        "advisory": "GHSA-25wp-cf8g-938m",
        "discovery": "UNKNOWN"
      },
      "title": "Denial of Service in ZeroMQ",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15166",
          "STATE": "PUBLIC",
          "TITLE": "Denial of Service in ZeroMQ"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "libzmq",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 4.3.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "zeromq"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400 Uncontrolled Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m",
              "refsource": "CONFIRM",
              "url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m"
            },
            {
              "name": "https://github.com/zeromq/libzmq/pull/3913",
              "refsource": "MISC",
              "url": "https://github.com/zeromq/libzmq/pull/3913"
            },
            {
              "name": "https://github.com/zeromq/libzmq/pull/3973",
              "refsource": "MISC",
              "url": "https://github.com/zeromq/libzmq/pull/3973"
            },
            {
              "name": "GLSA-202009-12",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202009-12"
            },
            {
              "name": "FEDORA-2020-08402f4071",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZ5IMNQXDB52JFBXHFLK4AHVORFELNNG/"
            },
            {
              "name": "FEDORA-2020-5460fcf6bd",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFW2ZELCCPS4VLU4OSJOH5YL6KFKTFYW/"
            },
            {
              "name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2443-1] zeromq3 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00017.html"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-25wp-cf8g-938m",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15166",
    "datePublished": "2020-09-11T15:35:14.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:22.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}