CVE-2020-15166

Katalog CVE

CVSS 7.5 · High EPSS 3,4%

Kerentanan Uncontrolled Resource Consumption pada zeromq libzmq, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

Rincian

Terbit di NVD

11 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

3,4% peluang dieksploitasi; lebih tinggi dari 88,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zeromq/libzmq/pull/3913 patch · advisory pihak ketiga
• https://github.com/zeromq/libzmq/pull/3973 patch · advisory pihak ketiga
• https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/11/msg00017.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202009-12 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ5IMNQXDB52J...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFW2ZELCCPS4V...