CVE-2021-20235

There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality.

CVSS v3 8.1 HIGH
CVSS v2.0 6.8 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1921983	Issue Tracking Patch Third Party Advisory
https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6	Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1921983	Issue Tracking Patch Third Party Advisory
https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:46

Type	Values Removed	Values Added
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=1921983 - Issue Tracking, Patch, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=1921983 - Issue Tracking, Patch, Third Party Advisory
References	~~() https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6 - Patch, Third Party Advisory~~	() https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6 - Patch, Third Party Advisory

Information

Published : 2021-04-01 14:15

Updated : 2024-11-21 05:46

NVD link : CVE-2021-20235

Mitre link : CVE-2021-20235

CVE.ORG link : CVE-2021-20235

JSON object : View

Products Affected

zeromq

libzmq

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-787

Out-of-bounds Write

{"id": "CVE-2021-20235", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2021-04-01T14:15:13.217", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6", "tags": ["Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921983", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-120"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server could trigger a buffer overflow WRITE of arbitrary data if CURVE/ZAP authentication is not enabled. The greatest impact of this flaw is to application availability, data integrity, and confidentiality."}, {"lang": "es", "value": "Se presenta un fallo en el servidor zeromq en versiones anteriores a 4.3.3, en el archivo src/decoder_allocators.hpp. Se podr\u00eda cambiar el tama\u00f1o del asignador est\u00e1tico del decodificador, pero el b\u00fafer permanecer\u00eda igual, ya que es un b\u00fafer est\u00e1tico. Un atacante no autenticado remoto que env\u00eda una petici\u00f3n dise\u00f1ada al servidor zeromq podr\u00eda desencadenar un desbordamiento del b\u00fafer WRITE de datos arbitrarios si la autenticaci\u00f3n CURVE/ZAP no est\u00e1 habilitada. El mayor impacto de este fallo es la disponibilidad de la aplicaci\u00f3n, la integridad de los datos y la confidencialidad."}], "lastModified": "2024-11-21T05:46:11.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1384189-AC6C-4847-A3BF-FB7A3A826F75", "versionEndExcluding": "4.3.3", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}