CVE-2020-15166
Denial of Service in ZeroMQ
- State
- Published
- Severity
- 7.5 High
- Published
- Sep 11, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jun 25, 2020
Description
In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitHub_M |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
libzmqzeromq |
|
References
- https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m
- https://github.com/zeromq/libzmq/pull/3913
- https://github.com/zeromq/libzmq/pull/3973
- GLSA-202009-12vendor-advisory
- FEDORA-2020-08402f4071vendor-advisory
- FEDORA-2020-5460fcf6bdvendor-advisory
- [debian-lts-announce] 20201110 [SECURITY] [DLA 2443-1] zeromq3 security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.