Denial-of-Service Vulnerability in ZeroMQ: Impacting Multiple Alpine Versions
Summary
ALPINE-CVE-2020-15166: In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Affects zeromq versions < 4.3.3-r0. Fixed in 4.3.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZeroMQ is a high-performance asynchronous messaging library aimed at use in scalable distributed or concurrent applications. It provides a message queue, but unlike traditional message brokers, it allows for direct socket communication between applications. This flexibility makes it a popular choice for developers. However, a vulnerability has been identified in versions prior to 4.3.3 that can lead to denial-of-service (DoS) conditions when using TCP transport public endpoints.
Vulnerability Detail
In ZeroMQ versions before 4.3.3, a denial-of-service vulnerability exists that affects users with TCP transport public endpoints, even when CURVE/ZAP security features are enabled. The issue arises when a raw TCP socket is opened and connected to a fully configured CURVE/ZAP endpoint. Although handshakes complete successfully and messages are delivered to the library, the server application fails to receive them, effectively blocking legitimate clients from exchanging messages. This vulnerability can severely disrupt communication in applications relying on ZeroMQ for messaging.
How To Fix
Minimum fixed version
4.3.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade zeromqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling TCP transport public endpoints or implementing additional security measures to restrict access to the ZeroMQ service until the package can be updated.
Conclusion
The denial-of-service vulnerability in ZeroMQ affects multiple versions of the package across various Alpine distributions. It is crucial for users to update to version 4.3.3 or later to mitigate the risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software effectively.
See every vulnerability recorded for zeromq →
FAQ
ZeroMQ is a messaging library that allows applications to communicate with each other using sockets, providing high-performance messaging capabilities.
The vulnerability allows attackers to prevent legitimate clients from exchanging messages with the server, effectively disrupting communication.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for zeromq.
