PT-2020-6244 · Zeromq · Libzmq

Published 2020-05-08 · Updated 2021-07-06 · CVE-2020-36400

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libzmq version 4.3.3

Description The issue is related to a heap-based buffer overflow in the zmq::tcp read() function of the libzmq library, which is part of the ZeroMQ asynchronous messaging library. This can lead to a denial of service. The vulnerability can be exploited by a remote attacker.

Recommendations For libzmq version 4.3.3, consider disabling the zmq::tcp read() function as a temporary workaround until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2021-03690

CVE-2020-36400

Affected Products

Libzmq

References · 8

• https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306 · Patch
• https://bdu.fstec.ru/vul/2021-03690 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36400 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36400 · Vendor Advisory
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 · Patch
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libzmq/OSV-2020-1887.yaml · Note
• https://access.redhat.com/security/cve/cve-2020-36400 · Note
• https://vuldb.com/?id.177860 · Note