PatchTheCVEzeromq vulnerabilities
Recent CVEs affecting zeromq products. 11 tracked.
zeromq has 11 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 8. Most recent: 2021-07-01. Highest priority: CVE-2019-13132 (score 69/100).
- CVE-2021-20237 HIGH 7.5 UPGRADE An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before
- CVE-2021-20236 CRITICAL 9.8 UPGRADE DOWNGRADE A flaw was found in the ZeroMQ server in versions before 4.3.3
- CVE-2021-20235 HIGH 8.1 UPGRADE There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp
- CVE-2021-20234 MEDIUM 6.5 UPGRADE An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.
- CVE-2020-36400 CRITICAL 9.8 DOWNGRADE ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021
- CVE-2020-15166 HIGH 7.5 UPGRADE MITIGATE In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability
- CVE-2019-6250 HIGH 8.8 UPGRADE MITIGATE A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.
- CVE-2019-13132 CRITICAL 9.8 UPGRADE MITIGATE In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client co
- CVE-2014-9721 MEDIUM 4.3 UPGRADE libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMT
- CVE-2014-7203 MEDIUM 4.3 DOWNGRADE libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-mid
- CVE-2014-7202 MEDIUM 4.3 DOWNGRADE stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct
FAQ
How do I fix zeromq vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zeromq being exploited right now?
None of the tracked zeromq CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zeromq CVE should I patch first?
CVE-2019-13132 currently ranks highest (69/100): In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client co.