Candidate: CVE-2021-20235
PublicDate: 2021-04-01 14:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20235
 https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6
Description:
 There's a flaw in the zeromq server in versions before 4.3.3 in
 src/decoder_allocators.hpp. The decoder static allocator could have its
 sized changed, but the buffer would remain the same as it is a static
 buffer. A remote, unauthenticated attacker who sends a crafted request to
 the zeromq server could trigger a buffer overflow WRITE of arbitrary data
 if CURVE/ZAP authentication is not enabled. The greatest impact of this
 flaw is to application availability, data integrity, and confidentiality.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21984
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H [8.1 HIGH]


Patches_zeromq3:
 upstream: https://github.com/zeromq/libzmq/pull/3902
upstream_zeromq3: released (4.3.3-1)
precise/esm_zeromq3: DNE
trusty_zeromq3: ignored (out of standard support)
trusty/esm_zeromq3: needs-triage
xenial_zeromq3: ignored (end of standard support, was needs-triage)
bionic_zeromq3: needed
focal_zeromq3: needed
groovy_zeromq3: ignored (reached end-of-life)
hirsute_zeromq3: not-affected (4.3.4-1)
impish_zeromq3: not-affected (4.3.4-1)
jammy_zeromq3: not-affected (4.3.4-1)
devel_zeromq3: not-affected (4.3.4-1)