CVE-2014-7202 stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request.
MediumCVSS 4.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/zeromq3(Debian:12) | < 4.0.5+dfsg-1 | 4.0.5+dfsg-1 |
| debian/zeromq3(Debian:13) | < 4.0.5+dfsg-1 | 4.0.5+dfsg-1 |
| debian/zeromq3(Debian:14) | < 4.0.5+dfsg-1 | 4.0.5+dfsg-1 |
| zeromq | = 4.0.0 | No fix listed |
| zeromq | = 4.0.4 | No fix listed |
References
- Debian Security Tracker CVE-2014-7202 vendor-advisory
- openSUSE-SU-2014:1381 vendor-advisory
- openSUSE-SU-2014:1493 vendor-advisory
- [oss-security] 20140926 CVE request: zeromq mailing-list
- [oss-security] 20140927 Re: CVE request: zeromq mailing-list
- 62262 third-party-advisory
- 70157 vdb-entry
- zeromq-handshake-sec-bypass(96241) vdb-entry
- github.com
- github.com