CoreCVE
Back

HIGH

Denial of Service in ZeroMQ

Published Sep 11, 2020

Description

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

Affected products

Remediation

Red Hat statement

Red Hat Ceph Storage 2 is now in the Extended Life Support (ELS) Phase of the support and maintenance life cycle and receives only qualified Important and Critical impact security fixes. This issue has been rated as having a security impact of Moderate and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Ceph Storage Life Cycle: https://access.redhat.com/articles/1372203

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Sep 11, 2020
Updated Aug 4, 2024
Reserved Jun 25, 2020
Link CVE-2020-15166
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-15166
Red Hat
Severity Moderate
Public date Sep 7, 2020
Links CVE-2020-15166 - Bugzilla