A CVE was requested for a security issue in zeromq 4.0.5: http://openwall.com/lists/oss-security/2015/05/07/8 The upstream commit to fix the issue is linked in the message above. Reproducible: Steps to Reproduce:
This issue is fixed in version 4.0.6 along with other bug fixes: 0MQ version 4.0.6 stable, released on 2015/12/xx ================================================ * Fixed #1273 - V3 protocol handler vulnerable to downgrade attacks. * Fixed #1362 - SUB socket sometimes fails to resubscribe properly. * Fixed #1377, #1144 - failed with WSANOTINITIALISED in some cases. * Fixed #1389 - PUB, PUSH sockets had slow memory leak. * Fixed #1382 - zmq_proxy did not terminate if there were no readers. =============================================== I am updating to this version in svn and will ask for push of this and rebuild of gnuradio.
Ahh, nice. When I checked yesterday, 4.0.6 didn't seem to be available.
Committed and asked for push - no need to rebuild gnuradio although I did bump release in svn.
(In reply to David Walser from comment #2) > Ahh, nice. When I checked yesterday, 4.0.6 didn't seem to be available. Well, it's not on the site as a tarball, but I made the tarball from git stable branch which has the above bug fixes and has the 4.0.6 version flag.
(In reply to Barry Jackson from comment #4) > (In reply to David Walser from comment #2) > > Ahh, nice. When I checked yesterday, 4.0.6 didn't seem to be available. > > Well, it's not on the site as a tarball, but I made the tarball from git > stable branch which has the above bug fixes and has the 4.0.6 version flag. Ahh, so perhaps it's not actually released yet. Maybe use a 0.1 release tag, just in case?
To be clear, the snippet in #1 is from the NEWS in the tarball.
OK now 0.1 in svn as it may not actually be *final* 4.0.6.
zeromq-4.0.6-0.1.mga5 uploaded for Cauldron. Thanks Barry!
Status: NEW => RESOLVEDResolution: (none) => FIXED
Debian has issued an advisory for this on May 10: https://www.debian.org/security/2015/dsa-3255
URL: (none) => http://lwn.net/Vulnerabilities/643919/
CVE-2014-9721 has been assigned: http://openwall.com/lists/oss-security/2015/05/21/4
Summary: zeromq new protocol downgrade attack security issue => zeromq new protocol downgrade attack security issue (CVE-2014-9721)
LWN reference with the CVE: http://lwn.net/Vulnerabilities/646896/