[ GLSA 202009-12 ] ZeroMQ

[GLSA]

Gentoo Linux Security Advisory

Title: ZeroMQ: Denial of service (GLSA 202009-12)
Severity: normal
Exploitable: local, remote
Date: 2020-09-13
Bug(s): #740574
ID: 202009-12

Synopsis

A vulnerability in ZeroMQ could lead to a Denial of Service
condition.


Background

Looks like an embeddable networking library but acts like a concurrency
framework.


Affected Packages

Package: net-libs/zeromq
Vulnerable: < 4.3.3
Unaffected: >= 4.3.3
Architectures: All supported architectures


Description

It was discovered that ZeroMQ does not properly handle connecting peers
before a handshake is completed.


Impact

An unauthenticated remote attacker able to connect to a ZeroMQ endpoint,
even with CURVE encryption/authentication enabled, can cause a Denial of
Service condition.


Workaround

There is no known workaround at this time.

Resolution

All ZeroMQ users should upgrade to the latest version: