CVE-2020-15166

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-15166
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15166.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15166
Aliases
  • GHSA-25wp-cf8g-938m
Related
Published
2020-09-11T16:15:12Z
Modified
2024-09-18T03:07:55.408663Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

References

Affected packages

Alpine:v3.10 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0
4.3.2-r1

Alpine:v3.11 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.12 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.13 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.14 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.15 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.16 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.17 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.18 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.19 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.20 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Alpine:v3.9 / zeromq

Package

Name
zeromq
Purl
pkg:apk/alpine/zeromq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-r0

Affected versions

2.*

2.0.10-r0
2.1.7-r0
2.1.7-r1
2.1.7-r2
2.1.10-r0
2.1.11-r0
2.2.0-r0
2.2.0-r1

3.*

3.2.2-r0
3.2.3-r0
3.2.3-r1
3.2.4-r0

4.*

4.0.4-r0
4.0.5-r0
4.1.1-r0
4.1.2-r0
4.1.3-r0
4.1.3-r1
4.1.3-r2
4.1.3-r3
4.1.4-r0
4.1.5-r0
4.1.5-r1
4.2.2-r0
4.2.2-r1
4.2.2-r2
4.2.3-r0
4.2.5-r0
4.3.1-r0
4.3.2-r0

Debian:11 / zeromq3

Package

Name
zeromq3
Purl
pkg:deb/debian/zeromq3?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / zeromq3

Package

Name
zeromq3
Purl
pkg:deb/debian/zeromq3?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / zeromq3

Package

Name
zeromq3
Purl
pkg:deb/debian/zeromq3?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/zeromq/libzmq

Affected ranges

Type
GIT
Repo
https://github.com/zeromq/libzmq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
04f5bbedee58c538934374dc45182d8fc5926fa3

Affected versions

v3.*

v3.1.0
v3.2.1

v4.*

v4.1.0
v4.2.0
v4.2.0-rc1
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.3.0
v4.3.1
v4.3.2