PT-2021-30842 · Zeromq · Zeromq

Published 2021-03-30 · Updated 2021-03-30

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions zeromq (affected versions not specified)

Description The issue involves several problems, including a memory leak in the client caused by a malicious server without CURVE/ZAP, a stack overflow on the server running PUB/XPUB socket, a heap overflow when receiving malformed ZMTP v1 packets, and memory leaks via metadata messages processed by PUB sockets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2021-0159

Affected Products

Zeromq

References · 5

• https://osv.dev/vulnerability/MGASA-2021-0159 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/A73URKLEFEB5USSGSLKTP7XWE5JUKSB7 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0159.html · Security Note
• https://lists.zeromq.org/pipermail/zeromq-announce/2021-January/000068.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=28320 · Note