Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2020:1907-1

Опубликовано: 13 нояб. 2020
Источник: suse-cvrf

Описание

Security update for zeromq

This update for zeromq fixes the following issues:

  • CVE-2020-15166: Fixed the possibility of unauthenticated clients causing a denial-of-service (bsc#1176116).
  • Fixed a heap overflow when receiving malformed ZMTP v1 packets (bsc#1176256)
  • Fixed a memory leak in client induced by malicious server(s) without CURVE/ZAP (bsc#1176257)
  • Fixed memory leak when processing PUB messages with metadata (bsc#1176259)
  • Fixed a stack overflow in PUB/XPUB subscription store (bsc#1176258)

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.1
libunwind-1.2.1-lp151.4.3.1
libunwind-32bit-1.2.1-lp151.4.3.1
libunwind-devel-1.2.1-lp151.4.3.1
libzmq5-4.2.3-lp151.5.6.1
zeromq-devel-4.2.3-lp151.5.6.1
zeromq-tools-4.2.3-lp151.5.6.1

Ссылки

Описание

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

Затронутые продукты
openSUSE Leap 15.1:libunwind-1.2.1-lp151.4.3.1
openSUSE Leap 15.1:libunwind-32bit-1.2.1-lp151.4.3.1
openSUSE Leap 15.1:libunwind-devel-1.2.1-lp151.4.3.1
openSUSE Leap 15.1:libzmq5-4.2.3-lp151.5.6.1
Ссылки