[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20140927043210.3373DC5051E@smtptsrv1.mitre.org>
Date: Sat, 27 Sep 2014 00:32:10 -0400 (EDT)
From: cve-assign@...re.org
To: rf@...eap.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: zeromq
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> did not validate the other party's security handshake properly,
> allowing a man-in-the-middle downgrade attack.
> https://github.com/zeromq/libzmq/issues/1190
Use CVE-2014-7202.
> libzmq (ZeroMQ/C++) did not implement a uniqueness check on connection
> nonces, and the CurveZMQ RFC was ambiguous about nonce validation.
> This allowed replay attacks.
> https://github.com/zeromq/libzmq/issues/1191
Use CVE-2014-7203.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUJj1gAAoJEKllVAevmvms22oIALa4cmzIr+BMlDJvOW1jqBG3
WxIMxb3UEW58SSElxlXOaO8WniY3DepSMHqS6YfVIzpKzKtB0KTmQyurOqpNdGkH
uVrj5UXOT+fCqySURRDAJambPw2XdqauXHxABmFGrfBR97Lx9buTIH5Q0NCW5ZD5
T4Vkl1tTzv9IcYXhzcDeqqxLALvm4Fl7blvoxwhI5nWcPYCCzIowHz5aCqNT+Waw
WQ6f8ba1C3mvdmEZKBUtQ+lFdvqFFIZxS4tXgoCCLkOq6nj1nTiKDyxyd1BjCJIn
xf80XD+fEsMUUTiSL8GebqOPwzC8UD9c9RRslPqmOIP5QC81XBDXITRWx55lzWg=
=9D3H
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
