Stay Secure with the Latest Linux Advisories

security advisorysecurity updatezeromq

Mageia: 2020-0367 Critical: Zeromq TCP Message Exchange Flaw

If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them (CVE-2020-15166). . MGASA-2020-0367 - Updated zeromq packages fix security vulnerability Publication date: 15 Sep 2020 URL: https://advisories.mageia.org/MGASA-2020-0367.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-15166 If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them (CVE-2020-15166). Also, the cppzmq package has been rebuilt against the updated zeromq library. References: - https://bugs.mageia.org/show_bug.cgi?id=27256 - https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m - https://www.cve.org/CVERecord?id=CVE-2020-15166 SRPMS: - 7/core/zeromq-4.3.3-1.1.mga7 - 7/core/cppzmq-4.3.0-2.2.mga7 . Mageia enhances zeromq to address the security vulnerability impacting TCP communication through CURVE/ZAP settings.. zeromq security, Mageia security advisory, CURVE/ZAP TCP issue, message delivery failure. . Severity: Critical. LinuxSecurity.com Team

Sep 15, 2020 •Critical Mageia