CVE-2020-36400: 
ZeroMQ vulnerability analysis and mitigation

ZeroMQ libzmq version 4.3.3 contains a heap-based buffer overflow vulnerability in the zmq::tcp_read function. This vulnerability is distinct from CVE-2021-20235 and was discovered on September 30, 2020 (OSS-Fuzz).

The vulnerability is classified as a heap-based buffer overflow WRITE vulnerability that occurs in the zmq::tcp_read function, specifically within the call stack of zmq::stream_engine_base_t::read and zmq::stream_engine_base_t::in_event_internal. The issue was introduced in version 4.3.3 and has been assigned a HIGH severity rating (OSS-Fuzz-Vulns).

The vulnerability could potentially allow attackers to cause heap buffer overflow conditions, which might lead to arbitrary code execution or system crashes. The CVSS score of 7.0 indicates a high severity issue with potential impacts on confidentiality, integrity, and availability (Rapid7).

The vulnerability was discovered through OSS-Fuzz testing and was documented in their issue tracking system. The issue was introduced by commit b56195e995e0875afabf405826d97b1dd9817bb0 in version 4.3.3 (OSS-Fuzz-Vulns).

The vulnerability was fixed in commit 397ac80850bf8d010fae23dd215db0ee2c677306, which addressed the issue by preventing unnecessary resizing of the static allocator. Users should upgrade to a version containing this fix (GitHub-Commit).