CVE-2020-15166

Name	CVE-2020-15166
Description	In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2443-1, DSA-4761-1, ELA-313-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
zeromq3 (PTS)	jessie, jessie (lts)	4.0.5+dfsg-2+deb8u4	fixed
	stretch (security), stretch (lts), stretch	4.2.1-4+deb9u4	fixed
	buster, buster (lts)	4.3.1-4+deb10u3	fixed
	buster (security)	4.3.1-4+deb10u2	fixed
	bullseye	4.3.4-1+deb11u1	fixed
	bookworm	4.3.4-6	fixed
	sid, trixie	4.3.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
zeromq3	source	jessie	4.0.5+dfsg-2+deb8u3	ELA-313-1
zeromq3	source	stretch	4.2.1-4+deb9u3	DLA-2443-1
zeromq3	source	buster	4.3.1-4+deb10u2	DSA-4761-1
zeromq3	source	(unstable)	4.3.3-1

Notes

https://www.openwall.com/lists/oss-security/2020/09/07/3
https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m
https://github.com/zeromq/libzmq/commit/e7f0090b161ce6344f6bd35009816a925c070b09