Resource exhaustion in Zeromq Libzmq
CVE-2020-15166
In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.034 (87.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Zeromq Libzmq — versions < 4.3.3
- Debian Debian_linux — versions 9.0
- Fedoraproject Fedora — versions 32, 33
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- security-advisories@github.com (x_refsource_FEDORA, vendor-advisory)
- security-advisories@github.com (x_refsource_FEDORA, vendor-advisory)
- security-advisories@github.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-15166?
- CVE-2020-15166 is a high-severity vulnerability in Zeromq Libzmq, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2020-09-11.
- How severe is CVE-2020-15166?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2020-15166 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.