Hello community, here is the log from the commit of package zeromq for openSUSE:Factory checked in at 2020-11-30 09:52:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/zeromq (Old) and /work/SRC/openSUSE:Factory/.zeromq.new.5913 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "zeromq" Mon Nov 30 09:52:56 2020 rev:38 rq:839566 version:4.3.3 Changes: -------- --- /work/SRC/openSUSE:Factory/zeromq/zeromq.changes 2019-07-16 08:38:32.831079320 +0200 +++ /work/SRC/openSUSE:Factory/.zeromq.new.5913/zeromq.changes 2020-11-30 09:52:59.069728939 +0100 @@ -1,0 +2,44 @@ +Mon Sep 7 16:56:09 UTC 2020 - Adam Majer <[email protected]> + +- New upstream version 4.3.3: + * Denial-of-Service on CURVE/ZAP-protected servers by + unauthenticated clients. (CVE-2020-15166, bsc#1176116) + If a raw TCP socket is opened and connected to an endpoint that is fully + configured with CURVE/ZAP, legitimate clients will not be able to exchange + any message. Handshakes complete successfully, and messages are delivered to + the library, but the server application never receives them. + For more information see the security advisory: + https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m + * Stack overflow on server running PUB/XPUB socket (CURVE disabled). + The PUB/XPUB subscription store (mtrie) is traversed using recursive + function calls. In the remove (unsubscription) case, the recursive calls are + NOT tail calls, so even with optimizations the stack grows linearly with the + length of a subscription topic. Topics are under the control of remote + clients - they can send a subscription to arbitrary length topics. An + attacker can thus cause a server to create an mtrie sufficiently large such + that, when unsubscribing, traversal will cause a stack overflow. (bsc#1176258) + For more information see the security advisory: + https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8 + * Memory leak in PUB server induced by malicious client(s) without CURVE/ZAP. + Messages with metadata are never processed by PUB sockets, but the metadata + is kept referenced in the PUB object and never freed. (bsc#1176257) + For more information see the security advisory: + https://github.com/zeromq/libzmq/security/advisories/GHSA-4p5v-h92w-6wxw + * Memory leak in client induced by malicious server(s) without CURVE/ZAP. + When a pipe processes a delimiter and is already not in active state but + still has an unfinished message, the message is leaked. (bsc#1176259) + For more information see the security advisory: + https://github.com/zeromq/libzmq/security/advisories/GHSA-wfr2-29gj-5w87 + * Heap overflow when receiving malformed ZMTP v1 packets (CURVE disabled). + By crafting a packet which is not valid ZMTP v2/v3, and which has two + messages larger than 8192 bytes, the decoder can be tricked into changing + the recorded size of the 8192 bytes static buffer, which then gets overflown + by the next message. The content that gets written in the overflown memory + is entirely decided by the sender. (bsc#1176256) + For more information see the security advisory: + https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6 + +For complete list of changes, see +https://github.com/zeromq/libzmq/releases/tag/v4.3.3 + +------------------------------------------------------------------- Old: ---- zeromq-4.3.2.tar.gz New: ---- zeromq-4.3.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ zeromq.spec ++++++ --- /var/tmp/diff_new_pack.BY7VrO/_old 2020-11-30 09:53:00.861730646 +0100 +++ /var/tmp/diff_new_pack.BY7VrO/_new 2020-11-30 09:53:00.861730646 +0100 @@ -1,7 +1,7 @@ # # spec file for package zeromq # -# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2020 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -23,7 +23,7 @@ %bcond_with pgm %endif Name: zeromq -Version: 4.3.2 +Version: 4.3.3 Release: 0 Summary: Lightweight messaging kernel License: LGPL-3.0-or-later ++++++ zeromq-4.3.2.tar.gz -> zeromq-4.3.3.tar.gz ++++++ ++++ 275629 lines of diff (skipped) _______________________________________________ openSUSE Commits mailing list -- [email protected] To unsubscribe, email [email protected] List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette List Archives: https://lists.opensuse.org/archives/list/[email protected]
