Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 27 Sep 2014 00:32:10 -0400 (EDT)
From: cve-assign@...re.org
To: rf@...eap.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: zeromq

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> did not validate the other party's security handshake properly,
> allowing a man-in-the-middle downgrade attack.
> https://github.com/zeromq/libzmq/issues/1190

Use CVE-2014-7202.


> libzmq (ZeroMQ/C++) did not implement a uniqueness check on connection
> nonces, and the CurveZMQ RFC was ambiguous about nonce validation.
> This allowed replay attacks.
> https://github.com/zeromq/libzmq/issues/1191

Use CVE-2014-7203.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJUJj1gAAoJEKllVAevmvms22oIALa4cmzIr+BMlDJvOW1jqBG3
WxIMxb3UEW58SSElxlXOaO8WniY3DepSMHqS6YfVIzpKzKtB0KTmQyurOqpNdGkH
uVrj5UXOT+fCqySURRDAJambPw2XdqauXHxABmFGrfBR97Lx9buTIH5Q0NCW5ZD5
T4Vkl1tTzv9IcYXhzcDeqqxLALvm4Fl7blvoxwhI5nWcPYCCzIowHz5aCqNT+Waw
WQ6f8ba1C3mvdmEZKBUtQ+lFdvqFFIZxS4tXgoCCLkOq6nj1nTiKDyxyd1BjCJIn
xf80XD+fEsMUUTiSL8GebqOPwzC8UD9c9RRslPqmOIP5QC81XBDXITRWx55lzWg=
=9D3H
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.