libzmq 4.1.8

0MQ version 4.1.8 stable, released on 2020/09/07

• Security advisories:
  • CVE-2020-15166: Denial-of-Service on CURVE/ZAP-protected servers by
    unauthenticated clients.
    If a raw TCP socket is opened and connected to an endpoint that is fully
    configured with CURVE/ZAP, legitimate clients will not be able to exchange
    any message. Handshakes complete successfully, and messages are delivered to
    the library, but the server application never receives them.
    For more information see the security advisory:
    GHSA-25wp-cf8g-938m
  • Stack overflow on server running PUB/XPUB socket (CURVE disabled).
    The PUB/XPUB subscription store (mtrie) is traversed using recursive
    function calls. In the remove (unsubscription) case, the recursive calls are
    NOT tail calls, so even with optimizations the stack grows linearly with the
    length of a subscription topic. Topics are under the control of remote
    clients - they can send a subscription to arbitrary length topics. An
    attacker can thus cause a server to create an mtrie sufficiently large such
    that, when unsubscribing, traversal will cause a stack overflow.
    For more information see the security advisory:
    GHSA-qq65-x72m-9wr8
  • Memory leak in client induced by malicious server(s) without CURVE/ZAP.
    When a pipe processes a delimiter and is already not in active state but
    still has an unfinished message, the message is leaked.
    For more information see the security advisory:
    GHSA-wfr2-29gj-5w87

libzmq 4.1.7

0MQ version 4.1.7 stable, released on 2019/07/08

• CVE-2019-13132: a remote, unauthenticated client connecting to a
  libzmq application, running with a socket listening with CURVE
  encryption/authentication enabled, may cause a stack overflow and
  overwrite the stack with arbitrary data, due to a buffer overflow in
  the library. Users running public servers with the above configuration
  are highly encouraged to upgrade as soon as possible, as there are no
  known mitigations. All versions from 4.0.0 and upwards are affected.

• Fixed #2254 - zmq 4.1.6 cannot pub msg to a zmq 2.x

• Fixed #2623 - ZMQ_ROUTER: with ZMQ_ROUTER_MANDATORY, ZMQ_POLLOUT will now
  now return true only if at least one pipe is ready for writing

• Fixed #159 - off-by-one error leaves ZMQ_STREAM unusable

• Fixed #163 - Fix divide by zero, in case of race condition, with ZMQ_PUSH

• Fixed #164 - EHOSTDOWN socket error assertion

• Fixed #165 - inproc pub/sub does not work when sub connects/binds before pub
  does

• Fix parsing application metadata when using CURVE

v4.1.6

This is release 4.1.6

v4.1.5

This is release 4.1.5

v4.1.4

This is release 4.1.4

v4.1.3

This is release 4.1.3

v4.1.2

This is release 4.1.2

v4.1.1

This is release 4.1.1

v4.1.0

This is release 4.1.0 rc1