An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4920-1 advisory.

    It was discovered that ZeroMQ incorrectly handled certain application metadata. A remote attacker could     use this issue to cause ZeroMQ to crash, or possibly execute arbitrary code. (CVE-2019-13132)

    It was discovered that ZeroMQ mishandled certain network traffic. An unauthenticated attacker could use     this vulnerability to cause a denial-of- service and prevent legitimate clients from communicating with     ZeroMQ. (CVE-2020-15166)

    It was discovered that ZeroMQ did not properly manage memory under certain circumstances. If a user or     automated system were tricked into connecting to one or multiple compromised servers, a remote attacker     could use this issue to cause a denial of service. (CVE-2021-20234)

    It was discovered that ZeroMQ incorrectly handled memory when processing messages with arbitrarily large     sizes under certain circumstances. A remote unauthenticated attacker could use this issue to cause a     ZeroMQ server to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue     only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-20235)

    It was discovered that ZeroMQ did not properly manage memory under certain circumstances. A remote     unauthenticated attacker could use this issue to cause a ZeroMQ server to crash, resulting in a denial of     service. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-20237)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the zeromq package has been released.

Two security issues have been detected in zeromq3.

CVE-2021-20234

Memory leak in client induced by malicious server(s) without CURVE/ZAP.

From issue description [1]. When a pipe processes a delimiter and is already not in active state but still has an unfinished message, the message is leaked.

CVE-2021-20235

Heap overflow when receiving malformed ZMTP v1 packets.

From issue description [2]. The static allocator was implemented to shrink its recorded size similarly to the shared allocator. But it does not need to, and it should not, because unlike the shared one the static allocator always uses a static buffer, with a size defined by the ZMQ_IN_BATCH_SIZE socket option (default 8192), so changing the size opens the library to heap overflows. The static allocator is used only with ZMTP v1 peers.

[1] https://github.com/zeromq/libzmq/security/advisories/GHSA-wfr2-29gj-5w 87 [2] https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7h p6

For Debian 9 stretch, these problems have been fixed in version 4.2.1-4+deb9u4.

We recommend that you upgrade your zeromq3 packages.

For the detailed security status of zeromq3 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/zeromq3

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183116	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : ZeroMQ vulnerabilities (USN-4920-1)	Nessus	Ubuntu Local Security Checks	critical
150925	Photon OS 2.0: Zeromq PHSA-2021-2.0-0357	Nessus	PhotonOS Local Security Checks	critical
150922	Photon OS 1.0: Zeromq PHSA-2021-1.0-0403	Nessus	PhotonOS Local Security Checks	critical
150915	Photon OS 3.0: Zeromq PHSA-2021-3.0-0253	Nessus	PhotonOS Local Security Checks	critical
147685	Debian DLA-2588-1 : zeromq3 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-20234

medium

Tenable Plugins

critical

critical

critical

critical

high