Denial-of-Service Vulnerability in ZeroMQ
Summary
CVE-2020-15166: In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Affects zeromq across 2 version ranges.
< 4.3.3-r0
< 04f5bbedee58c538934374dc45182d8fc5926fa3
Fixed in 4.3.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZeroMQ is an open-source messaging library that allows applications to connect and exchange messages in a distributed system. It provides high-performance asynchronous communication between processes, threads, and nodes. ZeroMQ supports various transport protocols, including TCP. The vulnerability affects ZeroMQ versions before 4.3.3.
Vulnerability Detail
The vulnerability, identified as CVE-2020-15166, is a denial-of-service (DoS) issue. It impacts users with TCP transport public endpoints, even if CURVE/ZAP (ZeroMQ security mechanisms) are enabled. When a raw TCP socket is opened and connected to a fully configured CURVE/ZAP endpoint, legitimate clients are unable to exchange any messages. Handshakes are successful, and messages are delivered to the library, but the server application does not receive them. This vulnerability can disrupt communication and potentially lead to service unavailability.
How To Fix
Minimum fixed version
4.3.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade zeromqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
Conclusion
The denial-of-service vulnerability in ZeroMQ can disrupt communication between clients and the server application. It is crucial to update ZeroMQ to version 4.3.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for zeromq →
FAQ
ZeroMQ is an open-source messaging library that enables high-performance asynchronous communication between processes, threads, and nodes in a distributed system.
The vulnerability can cause a denial-of-service condition, preventing legitimate clients from exchanging messages with the server application.
ZeroMQ versions before 4.3.3 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. Updating to the patched version is recommended.
To fix this vulnerability, update ZeroMQ to version 4.3.3 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for zeromq.
