[Bug 1811531] Re: remote execution vulnerability
** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2011-3389 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2011-4944 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-0845 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-1150 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1437 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1752 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-4238 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-4314 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-0012 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-1829 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-1830 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-2667 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-4650 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-7202 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-7203 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-9721 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-2296 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-10745 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1238 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-9015 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-18342 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6512 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-20060 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-7750 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-10906 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-11236 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-11324 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13132 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-20907 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-20916 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-5010 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-8341 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9740 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-9947 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-14343 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-15166 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-15523 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-15801 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1747 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-25659 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-26137 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-27783 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28493 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-29651 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-36242 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-8492 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-23336 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-28957 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-29921 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3177 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-33503 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3426 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-2937 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-2940 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-3738 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4339 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-4343 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-7250 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-3108 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-4995 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-5135 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-0891 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-1672 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-5077 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-0590 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-0591 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-0789 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1377 ** CVE
[Bug 1811531] Re: remote execution vulnerability
** Changed in: zeromq (Suse) Status: Unknown => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
Thanks Luca, The packages are being uploaded and should be available in the archive in a few minutes. Thanks ** Changed in: zeromq3 (Ubuntu) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
Hi Eduardo, thanks for taking care of this. The amd64 binaries look fine to me. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
** Changed in: zeromq3 (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
** Changed in: zeromq3 (Ubuntu) Assignee: (unassigned) => Eduardo dos Santos Barretto (ebarretto) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
** Changed in: zeromq (Suse) Status: Confirmed => Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
** Bug watch added: github.com/zeromq/libzmq/issues #3351 https://github.com/zeromq/libzmq/issues/3351 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
This issue has been assigned CVE-2019-6250 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-6250 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
** Changed in: zeromq3 (Debian) Status: Unknown => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
The attachment "backported patch for 4.2.5" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team. [This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.] ** Tags added: patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
Launchpad has imported 1 comments from the remote bug at https://bugzilla.opensuse.org/show_bug.cgi?id=1121717. If you reply to an imported comment from within Launchpad, your comment will be sent to the remote bug automatically. Read more about Launchpad's inter-bugtracker facilities at https://help.launchpad.net/InterBugTracking. On 2019-01-12T17:40:09+00:00 Luca Boccassi wrote: Created attachment 794269 patch for 4.2.2 and 4.2.3 Dear Maintainer, A remote execution vulnerability has been reported in zeromq. Full details can be found on the upstream issue tracker [1]. The issue is fixed in upstream version v4.3.1, just released, or with the attached patch for 4.2.3 (leap 15) and 4.2.2 (leap 42) (applies cleanly on both). This issue has been introduced in 4.2.0 so SLES 12 is not affected. The latest version will hopefully arrive in disco via debian unstable soon, but I would recommend patching older releases. As mentioned in the upstream tracker and the changelog, the issue can be mitigated by ASLR and by authentication via CURVE/GSSAPI. As far as I am aware no CVEs have been assigned nor have been requested as of now. Reply at: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/comments/3 ** Changed in: zeromq (Suse) Status: Unknown => Confirmed ** Changed in: zeromq (Suse) Importance: Unknown => High -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
** Description changed: Dear Maintainer, A remote execution vulnerability has been reported in zeromq. Full details can be found on the upstream issue tracker [1]. The issue is fixed in upstream version v4.3.1, just released, or with the attached patch which is targeted for v4.2.5 (bionic and cosmic). The latest version will hopefully arrive in disco via debian unstable soon, but I would recommend patching older releases. As mentioned in the upstream tracker and the changelog, the issue can be mitigated by ASLR and by authentication via CURVE/GSSAPI. As far as I am aware no CVEs have been assigned nor have been requested as of now. + + [1] https://github.com/zeromq/libzmq/issues/3351 ** Bug watch added: Debian Bug tracker #919098 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919098 ** Also affects: zeromq3 (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919098 Importance: Unknown Status: Unknown ** Bug watch added: bugzilla.opensuse.org/ #1121717 https://bugzilla.opensuse.org/show_bug.cgi?id=1121717 ** Also affects: zeromq (Suse) via https://bugzilla.opensuse.org/show_bug.cgi?id=1121717 Importance: Unknown Status: Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811531] Re: remote execution vulnerability
Also note that this was introduced in 4.2.0, so xenial is not affected. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811531 Title: remote execution vulnerability To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zeromq3/+bug/1811531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
