CVE-2021-20235

{"containers": {"cna": {"affected": [{"product": "zeromq", "vendor": "n/a", "versions": [{"status": "affected", "version": "zeromq 4.3.3"}]}], "descriptions": [{"lang": "en", "value": "There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "description": "CWE-120->CWE-787", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-01T13:47:05.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2021-20235", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "zeromq", "version": {"version_data": [{"version_value": "zeromq 4.3.3"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-120->CWE-787"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983"}, {"name": "https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6", "refsource": "MISC", "url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:37:22.831Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2021-20235", "datePublished": "2021-04-01T13:47:05.000Z", "dateReserved": "2020-12-17T00:00:00.000Z", "dateUpdated": "2024-08-03T17:37:22.831Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "zeromq", "vendor": "n/a", "versions": [{"status": "affected", "version": "zeromq 4.3.3"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1384189-AC6C-4847-A3BF-FB7A3A826F75", "versionEndExcluding": "4.3.3", "versionStartIncluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality."}, {"lang": "es", "value": "Se presenta un fallo en el servidor zeromq en versiones anteriores a 4.3.3, en el archivo src/decoder_allocators.hpp. Se podr\u00eda cambiar el tama\u00f1o del asignador est\u00e1tico del decodificador, pero el b\u00fafer permanecer\u00eda igual, ya que es un b\u00fafer est\u00e1tico. Un atacante no autenticado remoto que env\u00eda una petici\u00f3n dise\u00f1ada al servidor zeromq podr\u00eda desencadenar un desbordamiento del b\u00fafer WRITE de datos arbitrarios si la autenticaci\u00f3n CURVE/ZAP no est\u00e1 habilitada. El mayor impacto de este fallo es la disponibilidad de la aplicaci\u00f3n, la integridad de los datos y la confidencialidad."}], "id": "CVE-2021-20235", "lastModified": "2026-06-17T03:33:31.373", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-01T14:15:13.217", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "zeromq: Heap overflow when receiving malformed ZMTP v1 packets", "id": "1921983", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-120->CWE-787", "details": ["There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality.", "There's a flaw in the zeromq server in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality."], "name": "CVE-2021-20235", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:2", "fix_state": "Out of support scope", "package_name": "zeromq3", "product_name": "Red Hat Ceph Storage 2"}], "public_date": "2020-09-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-20235\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-20235\nhttps://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6"], "threat_severity": "Moderate"}

{}