PT-2021-8015 · Zeromq+3 · Zeromq+3

Pedro Sampaio · Published 2021-05-28 · Updated 2024-04-03 · CVE-2021-20236

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZeroMQ versions prior to 4.3.3

Description A flaw in the ZeroMQ server allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. This poses a threat to confidentiality, integrity, and system availability.

Recommendations For versions prior to 4.3.3, update to version 4.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the ZeroMQ server or disabling the topic subscription feature until a patch is applied. Avoid using crafted topic subscription requests to minimize the risk of exploitation.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-787

Related Identifiers

ALT-PU-2022-1314

BDU:2024-02576

CVE-2021-20236

GHSA-QQ65-X72M-9WR8

Affected Products

Alt Linux

Astra Linux

Red Os

Zeromq

References · 15

• https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-20236 · Security Note
• https://ubuntu.com/security/CVE-2021-20236 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-20236 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20236 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20236 · Security Note
• https://bdu.fstec.ru/vul/2024-02576 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20236 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20236 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zeromq-cve-2021-20236 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvenotify/15187 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=1921976 · Note