ZeroMQ: Denial of service

Background

Looks like an embeddable networking library but acts like a concurrency framework.

Description

It was discovered that ZeroMQ does not properly handle connecting peers before a handshake is completed.

Impact

An unauthenticated remote attacker able to connect to a ZeroMQ endpoint, even with CURVE encryption/authentication enabled, can cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All ZeroMQ users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-libs/zeromq-4.3.3"