[ubuntu/trusty-security] zeromq3 4.0.4+dfsg-2ubuntu0.1 (Accepted)

[Eduardo dos Santos Barretto]

zeromq3 (4.0.4+dfsg-2ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE: man-in-the-middle attackers to conduct
    downgrade attacks via a crafted connection request.
    - debian/patches/CVE-2014-7202.patch: Solution: accept only the
      mechanism defined by the socket options.
    - CVE-2014-7202

  * SECURITY UPDATE: man-in-the-middle attackers to conduct replay
    attacks via unspecified vectors.
    - debian/patches/CVE-2014-7203.patch: Solution: ensure message
      short nonces are strictly increasing and validate them.
    - CVE-2014-7203

  * SECURITY UPDATE: remote attackers to conduct downgrade attacks
    and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2
    or earlier header.
    - debian/patches/CVE-2014-9721.patch: Solution: if security is
      defined on a socket, reject all V2 and earlier connections,
      unconditionally.
    - CVE-2014-9721

Date: 2018-08-07 16:00:21.071418+00:00
Changed-By: Eduardo dos Santos Barretto <eduardo.barretto at canonical.com>
https://launchpad.net/ubuntu/+source/zeromq3/4.0.4+dfsg-2ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.