CVE-2021-20237: High severity libzmq5 vulnerability
A flaw was found in zeromq before 4.3.3. Messages with metadata are never processed by PUB sockets, but the metadata is kept referenced in the PUB object and never freed leading to memory leaks.
References:
https://github.com/zeromq/libzmq/pull/3935 https://github.com/zeromq/libzmq/security/advisories/GHSA-4p5v-h92w-6wxw https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22344
Other sources
An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated attacker to send crafted PUB messages that consume excessive memory if the CURVE/ZAP authentication is disabled on the server, causing a denial of service. The highest threat from this vulnerability is to system availability.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this ZeroMQ vulnerability?
The vulnerability ID for this ZeroMQ vulnerability is CVE-2021-20237.
What is the severity rating of CVE-2021-20237?
CVE-2021-20237 has a severity rating of 7.5 (high).
How does CVE-2021-20237 impact ZeroMQ?
CVE-2021-20237 is an uncontrolled resource consumption (memory leak) flaw that allows a remote unauthenticated attacker to send crafted messages, consuming excessive memory if the CURVE/ZAP authentication is disabled on the ZeroMQ server.
Which versions of ZeroMQ are affected by CVE-2021-20237?
Versions before 4.3.3 of ZeroMQ are affected by CVE-2021-20237.
How can I fix CVE-2021-20237?
To fix CVE-2021-20237, upgrade ZeroMQ to version 4.3.3 or later.