Search
Find a vulnerability
Search criteria
8 vulnerabilities found for zeromq by zeromq
CVE-2021-20236 (GCVE-0-2021-20236)
Vulnerability from nvd – Published: 2021-05-28 10:42 – Updated: 2024-08-03 17:37
VLAI
EPSS
VEX
Summary
A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Severity
No CVSS data available.
CWE
- CWE-120 - >CWE-787
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1921976 | x_refsource_MISC |
| https://github.com/zeromq/libzmq/security/advisor… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:37:23.102Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921976"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "zeromq",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "zeromq 4.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120-\u003eCWE-787",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-28T10:42:19.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921976"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2021-20236",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "zeromq",
"version": {
"version_data": [
{
"version_value": "zeromq 4.3.3"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-120-\u003eCWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1921976",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921976"
},
{
"name": "https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8",
"refsource": "MISC",
"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-20236",
"datePublished": "2021-05-28T10:42:19.000Z",
"dateReserved": "2020-12-17T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:37:23.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-9721 (GCVE-0-2014-9721)
Vulnerability from nvd – Published: 2015-06-03 20:00 – Updated: 2024-08-06 13:55
VLAI
EPSS
VEX
Summary
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/zeromq/zeromq4-x/commit/b6e3e0… | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3255 | vendor-advisoryx_refsource_DEBIAN |
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
| http://lists.opensuse.org/opensuse-updates/2015-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/zeromq/libzmq/issues/1273 | x_refsource_CONFIRM |
Date Public
2015-05-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:55:04.751Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51"
},
{
"name": "DSA-3255",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3255"
},
{
"name": "FEDORA-2015-8635",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html"
},
{
"name": "openSUSE-SU-2015:1028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/issues/1273"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-30T13:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51"
},
{
"name": "DSA-3255",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3255"
},
{
"name": "FEDORA-2015-8635",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html"
},
{
"name": "openSUSE-SU-2015:1028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/issues/1273"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9721",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51"
},
{
"name": "DSA-3255",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3255"
},
{
"name": "FEDORA-2015-8635",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html"
},
{
"name": "openSUSE-SU-2015:1028",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html"
},
{
"name": "https://github.com/zeromq/libzmq/issues/1273",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/issues/1273"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9721",
"datePublished": "2015-06-03T20:00:00.000Z",
"dateReserved": "2015-05-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:55:04.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7203 (GCVE-0-2014-7203)
Vulnerability from nvd – Published: 2014-10-08 19:00 – Updated: 2024-08-06 12:40
VLAI
EPSS
VEX
Summary
libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://seclists.org/oss-sec/2014/q3/776 | mailing-listx_refsource_MLIST |
| http://lists.opensuse.org/opensuse-updates/2014-1… | vendor-advisoryx_refsource_SUSE |
| https://github.com/zeromq/libzmq/pull/1189 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2014-1… | vendor-advisoryx_refsource_SUSE |
| http://www.securityfocus.com/bid/70157 | vdb-entryx_refsource_BID |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://seclists.org/oss-sec/2014/q3/754 | mailing-listx_refsource_MLIST |
| https://github.com/zeromq/libzmq/issues/1191 | x_refsource_CONFIRM |
| http://secunia.com/advisories/62262 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2014-09-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:19.205Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/pull/1189"
},
{
"name": "openSUSE-SU-2014:1493",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/70157"
},
{
"name": "zeromq-connection-nonces-replay(96242)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96242"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/issues/1191"
},
{
"name": "62262",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62262"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-09-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-07T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/pull/1189"
},
{
"name": "openSUSE-SU-2014:1493",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/70157"
},
{
"name": "zeromq-connection-nonces-replay(96242)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96242"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/issues/1191"
},
{
"name": "62262",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62262"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-7203",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"name": "https://github.com/zeromq/libzmq/pull/1189",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/pull/1189"
},
{
"name": "openSUSE-SU-2014:1493",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70157"
},
{
"name": "zeromq-connection-nonces-replay(96242)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96242"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"name": "https://github.com/zeromq/libzmq/issues/1191",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/issues/1191"
},
{
"name": "62262",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62262"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-7203",
"datePublished": "2014-10-08T19:00:00.000Z",
"dateReserved": "2014-09-26T00:00:00.000Z",
"dateUpdated": "2024-08-06T12:40:19.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7202 (GCVE-0-2014-7202)
Vulnerability from nvd – Published: 2014-10-08 19:00 – Updated: 2024-08-06 12:40
VLAI
EPSS
VEX
Summary
stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://seclists.org/oss-sec/2014/q3/776 | mailing-listx_refsource_MLIST |
| http://lists.opensuse.org/opensuse-updates/2014-1… | vendor-advisoryx_refsource_SUSE |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| https://github.com/zeromq/libzmq/pull/1188 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2014-1… | vendor-advisoryx_refsource_SUSE |
| http://www.securityfocus.com/bid/70157 | vdb-entryx_refsource_BID |
| https://github.com/zeromq/libzmq/issues/1190 | x_refsource_CONFIRM |
| http://seclists.org/oss-sec/2014/q3/754 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/62262 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2014-09-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:19.212Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"name": "zeromq-handshake-sec-bypass(96241)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96241"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/pull/1188"
},
{
"name": "openSUSE-SU-2014:1493",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/70157"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/issues/1190"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"name": "62262",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62262"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-09-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-07T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"name": "zeromq-handshake-sec-bypass(96241)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96241"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/pull/1188"
},
{
"name": "openSUSE-SU-2014:1493",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/70157"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/issues/1190"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"name": "62262",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62262"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-7202",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"name": "zeromq-handshake-sec-bypass(96241)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96241"
},
{
"name": "https://github.com/zeromq/libzmq/pull/1188",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/pull/1188"
},
{
"name": "openSUSE-SU-2014:1493",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70157"
},
{
"name": "https://github.com/zeromq/libzmq/issues/1190",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/issues/1190"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"name": "62262",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62262"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-7202",
"datePublished": "2014-10-08T19:00:00.000Z",
"dateReserved": "2014-09-26T00:00:00.000Z",
"dateUpdated": "2024-08-06T12:40:19.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-20236 (GCVE-0-2021-20236)
Vulnerability from cvelistv5 – Published: 2021-05-28 10:42 – Updated: 2024-08-03 17:37
VLAI
EPSS
VEX
Summary
A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Severity
No CVSS data available.
CWE
- CWE-120 - >CWE-787
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1921976 | x_refsource_MISC |
| https://github.com/zeromq/libzmq/security/advisor… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:37:23.102Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921976"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "zeromq",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "zeromq 4.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120-\u003eCWE-787",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-28T10:42:19.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921976"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2021-20236",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "zeromq",
"version": {
"version_data": [
{
"version_value": "zeromq 4.3.3"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-120-\u003eCWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1921976",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921976"
},
{
"name": "https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8",
"refsource": "MISC",
"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-20236",
"datePublished": "2021-05-28T10:42:19.000Z",
"dateReserved": "2020-12-17T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:37:23.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-9721 (GCVE-0-2014-9721)
Vulnerability from cvelistv5 – Published: 2015-06-03 20:00 – Updated: 2024-08-06 13:55
VLAI
EPSS
VEX
Summary
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/zeromq/zeromq4-x/commit/b6e3e0… | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3255 | vendor-advisoryx_refsource_DEBIAN |
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
| http://lists.opensuse.org/opensuse-updates/2015-0… | vendor-advisoryx_refsource_SUSE |
| https://github.com/zeromq/libzmq/issues/1273 | x_refsource_CONFIRM |
Date Public
2015-05-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:55:04.751Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51"
},
{
"name": "DSA-3255",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3255"
},
{
"name": "FEDORA-2015-8635",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html"
},
{
"name": "openSUSE-SU-2015:1028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/issues/1273"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-30T13:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51"
},
{
"name": "DSA-3255",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3255"
},
{
"name": "FEDORA-2015-8635",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html"
},
{
"name": "openSUSE-SU-2015:1028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/issues/1273"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9721",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51"
},
{
"name": "DSA-3255",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3255"
},
{
"name": "FEDORA-2015-8635",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html"
},
{
"name": "openSUSE-SU-2015:1028",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html"
},
{
"name": "https://github.com/zeromq/libzmq/issues/1273",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/issues/1273"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9721",
"datePublished": "2015-06-03T20:00:00.000Z",
"dateReserved": "2015-05-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:55:04.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7203 (GCVE-0-2014-7203)
Vulnerability from cvelistv5 – Published: 2014-10-08 19:00 – Updated: 2024-08-06 12:40
VLAI
EPSS
VEX
Summary
libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://seclists.org/oss-sec/2014/q3/776 | mailing-listx_refsource_MLIST |
| http://lists.opensuse.org/opensuse-updates/2014-1… | vendor-advisoryx_refsource_SUSE |
| https://github.com/zeromq/libzmq/pull/1189 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2014-1… | vendor-advisoryx_refsource_SUSE |
| http://www.securityfocus.com/bid/70157 | vdb-entryx_refsource_BID |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://seclists.org/oss-sec/2014/q3/754 | mailing-listx_refsource_MLIST |
| https://github.com/zeromq/libzmq/issues/1191 | x_refsource_CONFIRM |
| http://secunia.com/advisories/62262 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2014-09-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:19.205Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/pull/1189"
},
{
"name": "openSUSE-SU-2014:1493",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/70157"
},
{
"name": "zeromq-connection-nonces-replay(96242)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96242"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/issues/1191"
},
{
"name": "62262",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62262"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-09-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-07T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/pull/1189"
},
{
"name": "openSUSE-SU-2014:1493",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/70157"
},
{
"name": "zeromq-connection-nonces-replay(96242)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96242"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/issues/1191"
},
{
"name": "62262",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62262"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-7203",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"name": "https://github.com/zeromq/libzmq/pull/1189",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/pull/1189"
},
{
"name": "openSUSE-SU-2014:1493",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70157"
},
{
"name": "zeromq-connection-nonces-replay(96242)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96242"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"name": "https://github.com/zeromq/libzmq/issues/1191",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/issues/1191"
},
{
"name": "62262",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62262"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-7203",
"datePublished": "2014-10-08T19:00:00.000Z",
"dateReserved": "2014-09-26T00:00:00.000Z",
"dateUpdated": "2024-08-06T12:40:19.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7202 (GCVE-0-2014-7202)
Vulnerability from cvelistv5 – Published: 2014-10-08 19:00 – Updated: 2024-08-06 12:40
VLAI
EPSS
VEX
Summary
stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://seclists.org/oss-sec/2014/q3/776 | mailing-listx_refsource_MLIST |
| http://lists.opensuse.org/opensuse-updates/2014-1… | vendor-advisoryx_refsource_SUSE |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| https://github.com/zeromq/libzmq/pull/1188 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-updates/2014-1… | vendor-advisoryx_refsource_SUSE |
| http://www.securityfocus.com/bid/70157 | vdb-entryx_refsource_BID |
| https://github.com/zeromq/libzmq/issues/1190 | x_refsource_CONFIRM |
| http://seclists.org/oss-sec/2014/q3/754 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/62262 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2014-09-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:19.212Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"name": "zeromq-handshake-sec-bypass(96241)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96241"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/pull/1188"
},
{
"name": "openSUSE-SU-2014:1493",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/70157"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeromq/libzmq/issues/1190"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"name": "62262",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62262"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-09-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-07T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"name": "zeromq-handshake-sec-bypass(96241)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96241"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/pull/1188"
},
{
"name": "openSUSE-SU-2014:1493",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/70157"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeromq/libzmq/issues/1190"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"name": "62262",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62262"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-7202",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140927 Re: CVE request: zeromq",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/776"
},
{
"name": "openSUSE-SU-2014:1381",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html"
},
{
"name": "zeromq-handshake-sec-bypass(96241)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96241"
},
{
"name": "https://github.com/zeromq/libzmq/pull/1188",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/pull/1188"
},
{
"name": "openSUSE-SU-2014:1493",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html"
},
{
"name": "70157",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70157"
},
{
"name": "https://github.com/zeromq/libzmq/issues/1190",
"refsource": "CONFIRM",
"url": "https://github.com/zeromq/libzmq/issues/1190"
},
{
"name": "[oss-security] 20140926 CVE request: zeromq",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q3/754"
},
{
"name": "62262",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62262"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-7202",
"datePublished": "2014-10-08T19:00:00.000Z",
"dateReserved": "2014-09-26T00:00:00.000Z",
"dateUpdated": "2024-08-06T12:40:19.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}