[<prev] [next>] [day] [month] [year] [list]
Message-ID: <32fef869c240906d269ba83b0187479cd9637925.camel@debian.org>
Date: Mon, 08 Jul 2019 17:23:43 +0100
From: Luca Boccassi <bluca@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2019-13132: zeromq/libzmq: denial of service via stack overflow
with arbitrary data
Hello,
A security vulnerability has been reported in libzmq/zeromq.
CVE-2019-13132: a remote, unauthenticated client connecting to a
libzmq application, running with a socket listening with CURVE
encryption/authentication enabled, may cause a stack overflow and
overwrite the stack with arbitrary data, due to a buffer overflow in
the library. Users running public servers with the above configuration
are highly encouraged to upgrade as soon as possible, as there are no
known mitigations. All versions from 4.0.0 and upwards are affected.
Thank you Fang-Pen Lin for finding the issue and reporting it!
The following upstream releases fixes the issue and will be shortly
available:
https://github.com/zeromq/libzmq/releases/tag/v4.3.2
https://github.com/zeromq/zeromq4-x/releases/tag/v4.0.9
https://github.com/zeromq/zeromq4-1/releases/tag/v4.1.7
Individual backported patches can be found on the upstream bug tracker,
and have been sent separately to the security teams of various
distributions:
https://github.com/zeromq/libzmq/issues/3558
The programs to reproduce the issue will be shared on the 15th of July.
--
Kind regards,
Luca Boccassi
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
