CVE-2014-7203 libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/zeromq3(Debian:12) | < 4.0.5+dfsg-1 | 4.0.5+dfsg-1 |
| debian/zeromq3(Debian:13) | < 4.0.5+dfsg-1 | 4.0.5+dfsg-1 |
| debian/zeromq3(Debian:14) | < 4.0.5+dfsg-1 | 4.0.5+dfsg-1 |
| zeromq | = 4.0.0 | No fix listed |
| zeromq | = 4.0.1 | No fix listed |
| zeromq | = 4.0.2 | No fix listed |
| zeromq | = 4.0.3 | No fix listed |
| zeromq | = 4.0.4 | No fix listed |
References
- Debian Security Tracker CVE-2014-7203 vendor-advisory
- openSUSE-SU-2014:1381 vendor-advisory
- openSUSE-SU-2014:1493 vendor-advisory
- [oss-security] 20140926 CVE request: zeromq mailing-list
- [oss-security] 20140927 Re: CVE request: zeromq mailing-list
- 62262 third-party-advisory
- 70157 vdb-entry
- zeromq-connection-nonces-replay(96242) vdb-entry
- github.com
- github.com