CVE-2019-13132

Description

In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.

How to fix CVE-2019-13132

To remediate CVE-2019-13132, upgrade the affected package to a fixed version below.

• —upgrade to 4.3.2-r0 or later
• —upgrade to 4.3.1-5 or later
• —upgrade to 4.0.5+dfsg-2+deb8u2 or later
• —upgrade to 4.2.1-4+deb9u2 or later

Is CVE-2019-13132 being exploited?

Moderate — EPSS is 22.3%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (4)

• from 0, < 4.3.2-r0
• from 0, < 4.3.1-5
• from 0, < 4.0.5+dfsg-2+deb8u2
• from 0, < 4.2.1-4+deb9u2

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2019-13132
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2019-13132