Buffer overflow in Zeromq
CVE-2021-20236
A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Vulnerability class: Buffer Overflow
EPSS: 0.016 (74.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Zeromq
- Fedoraproject Fedora — versions 33
- Redhat Ceph_storage — versions 2.0
- Redhat Enterprise_linux — versions 7.0
- N/a Zeromq — versions zeromq 4.3.3
Weakness classification (CWE)
References
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
- secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-20236?
- CVE-2021-20236 is a critical-severity vulnerability in Zeromq, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 9.8/10. Published 2021-05-28.
- How severe is CVE-2021-20236?
- Critical severity. CVSS v3 base score is 9.8 out of 10.