CVE-2019-13132

Опубликовано: 10 июл. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00033.html
Broken Link
http://www.openwall.com/lists/oss-security/2019/07/08/6
Mailing List
Release Notes
Third Party Advisory
http://www.securityfocus.com/bid/109284
Broken Link
Third Party Advisory
VDB Entry
https://fangpenlin.com/posts/2024/04/07/how-i-discovered-a-9-point-8-critical-security-vulnerability-in-zeromq-with-mostly-pure-luck/
https://github.com/zeromq/libzmq/issues/3558
Third Party Advisory
https://github.com/zeromq/libzmq/releases
Release Notes
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00007.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVCTNUEOFFZUNJOXFCYCF3C6Y6NDILI3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MK7SJYDJ7MMRRRPCUN3SCSE7YK6ZSHVS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6HINI24SL7CU6XIJWUOSGTZWEFOOL7X/
https://news.ycombinator.com/item?id=39970716
https://seclists.org/bugtraq/2019/Jul/13
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201908-17
Third Party Advisory
https://usn.ubuntu.com/4050-1/
Third Party Advisory
https://www.debian.org/security/2019/dsa-4477
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00033.html
Broken Link
http://www.openwall.com/lists/oss-security/2019/07/08/6
Mailing List
Release Notes
Third Party Advisory
http://www.securityfocus.com/bid/109284
Broken Link
Third Party Advisory
VDB Entry
https://fangpenlin.com/posts/2024/04/07/how-i-discovered-a-9-point-8-critical-security-vulnerability-in-zeromq-with-mostly-pure-luck/
https://github.com/zeromq/libzmq/issues/3558
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*

Версия до 4.0.9 (исключая)

cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*

Версия от 4.1.0 (включая) до 4.1.7 (исключая)

cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*

Версия от 4.2.0 (включая) до 4.3.2 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.28165

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2019-13132

CVSS3: 9.8

ubuntu

больше 6 лет назад

CVE-2019-13132

CVSS3: 7.1

redhat

больше 6 лет назад

CVE-2019-13132

CVSS3: 9.8

debian

больше 6 лет назад

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4. ...

openSUSE-SU-2019:1767-1

suse-cvrf

больше 6 лет назад

Security update for zeromq

SUSE-SU-2019:1785-1

suse-cvrf

больше 6 лет назад

Security update for zeromq

EPSS

Процентиль: 96%

0.28165

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-787