PatchTheCVEzeromq vulnerabilities and fixes
Recent CVEs affecting zeromq, with upgrade or downgrade steps. 4 tracked.
zeromq has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-05-28. Highest priority: CVE-2021-20236 (score 64/100).
- CVE-2021-20236 CRITICAL 9.8 UPGRADE DOWNGRADE A flaw was found in the ZeroMQ server in versions before 4.3.3
- CVE-2014-9721 MEDIUM 4.3 UPGRADE libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMT
- CVE-2014-7203 MEDIUM 4.3 DOWNGRADE libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-mid
- CVE-2014-7202 MEDIUM 4.3 DOWNGRADE stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct
FAQ
How do I fix zeromq vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zeromq being exploited right now?
None of the tracked zeromq CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zeromq CVE should I patch first?
CVE-2021-20236 currently ranks highest (64/100): A flaw was found in the ZeroMQ server in versions before 4.3.3.