Hello community,
here is the log from the commit of package zeromq for openSUSE:Factory checked in at 2020-11-30 09:52:56
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/zeromq (Old)
and /work/SRC/openSUSE:Factory/.zeromq.new.5913 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "zeromq"
Mon Nov 30 09:52:56 2020 rev:38 rq:839566 version:4.3.3
Changes:
--------
--- /work/SRC/openSUSE:Factory/zeromq/zeromq.changes 2019-07-16 08:38:32.831079320 +0200
+++ /work/SRC/openSUSE:Factory/.zeromq.new.5913/zeromq.changes 2020-11-30 09:52:59.069728939 +0100
@@ -1,0 +2,44 @@
+Mon Sep 7 16:56:09 UTC 2020 - Adam Majer
+
+- New upstream version 4.3.3:
+ * Denial-of-Service on CURVE/ZAP-protected servers by
+ unauthenticated clients. (CVE-2020-15166, bsc#1176116)
+ If a raw TCP socket is opened and connected to an endpoint that is fully
+ configured with CURVE/ZAP, legitimate clients will not be able to exchange
+ any message. Handshakes complete successfully, and messages are delivered to
+ the library, but the server application never receives them.
+ For more information see the security advisory:
+ https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m
+ * Stack overflow on server running PUB/XPUB socket (CURVE disabled).
+ The PUB/XPUB subscription store (mtrie) is traversed using recursive
+ function calls. In the remove (unsubscription) case, the recursive calls are
+ NOT tail calls, so even with optimizations the stack grows linearly with the
+ length of a subscription topic. Topics are under the control of remote
+ clients - they can send a subscription to arbitrary length topics. An
+ attacker can thus cause a server to create an mtrie sufficiently large such
+ that, when unsubscribing, traversal will cause a stack overflow. (bsc#1176258)
+ For more information see the security advisory:
+ https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8
+ * Memory leak in PUB server induced by malicious client(s) without CURVE/ZAP.
+ Messages with metadata are never processed by PUB sockets, but the metadata
+ is kept referenced in the PUB object and never freed. (bsc#1176257)
+ For more information see the security advisory:
+ https://github.com/zeromq/libzmq/security/advisories/GHSA-4p5v-h92w-6wxw
+ * Memory leak in client induced by malicious server(s) without CURVE/ZAP.
+ When a pipe processes a delimiter and is already not in active state but
+ still has an unfinished message, the message is leaked. (bsc#1176259)
+ For more information see the security advisory:
+ https://github.com/zeromq/libzmq/security/advisories/GHSA-wfr2-29gj-5w87
+ * Heap overflow when receiving malformed ZMTP v1 packets (CURVE disabled).
+ By crafting a packet which is not valid ZMTP v2/v3, and which has two
+ messages larger than 8192 bytes, the decoder can be tricked into changing
+ the recorded size of the 8192 bytes static buffer, which then gets overflown
+ by the next message. The content that gets written in the overflown memory
+ is entirely decided by the sender. (bsc#1176256)
+ For more information see the security advisory:
+ https://github.com/zeromq/libzmq/security/advisories/GHSA-fc3w-qxf5-7hp6
+
+For complete list of changes, see
+https://github.com/zeromq/libzmq/releases/tag/v4.3.3
+
+-------------------------------------------------------------------
Old:
----
zeromq-4.3.2.tar.gz
New:
----
zeromq-4.3.3.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ zeromq.spec ++++++
--- /var/tmp/diff_new_pack.BY7VrO/_old 2020-11-30 09:53:00.861730646 +0100
+++ /var/tmp/diff_new_pack.BY7VrO/_new 2020-11-30 09:53:00.861730646 +0100
@@ -1,7 +1,7 @@
#
# spec file for package zeromq
#
-# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2020 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -23,7 +23,7 @@
%bcond_with pgm
%endif
Name: zeromq
-Version: 4.3.2
+Version: 4.3.3
Release: 0
Summary: Lightweight messaging kernel
License: LGPL-3.0-or-later
++++++ zeromq-4.3.2.tar.gz -> zeromq-4.3.3.tar.gz ++++++
++++ 275629 lines of diff (skipped)
