oss-sec mailing list archives
Re: CVE request: zeromq
From: cve-assign () mitre org
Date: Sat, 27 Sep 2014 00:32:10 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
did not validate the other party's security handshake properly, allowing a man-in-the-middle downgrade attack. https://github.com/zeromq/libzmq/issues/1190
Use CVE-2014-7202.
libzmq (ZeroMQ/C++) did not implement a uniqueness check on connection nonces, and the CurveZMQ RFC was ambiguous about nonce validation. This allowed replay attacks. https://github.com/zeromq/libzmq/issues/1191
Use CVE-2014-7203. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUJj1gAAoJEKllVAevmvms22oIALa4cmzIr+BMlDJvOW1jqBG3 WxIMxb3UEW58SSElxlXOaO8WniY3DepSMHqS6YfVIzpKzKtB0KTmQyurOqpNdGkH uVrj5UXOT+fCqySURRDAJambPw2XdqauXHxABmFGrfBR97Lx9buTIH5Q0NCW5ZD5 T4Vkl1tTzv9IcYXhzcDeqqxLALvm4Fl7blvoxwhI5nWcPYCCzIowHz5aCqNT+Waw WQ6f8ba1C3mvdmEZKBUtQ+lFdvqFFIZxS4tXgoCCLkOq6nj1nTiKDyxyd1BjCJIn xf80XD+fEsMUUTiSL8GebqOPwzC8UD9c9RRslPqmOIP5QC81XBDXITRWx55lzWg= =9D3H -----END PGP SIGNATURE-----
Current thread:
- CVE request: zeromq rf (Sep 26)
- Re: CVE request: zeromq cve-assign (Sep 26)