libzmq (ZeroMQ/C++) did not implement a uniqueness check on connection nonces, and the CurveZMQ RFC was ambiguous about nonce validation. This allows an attacker to use a replay attacks on zeroMQ connections.
Upstream commit: https://github.com/steamraven/libzmq/commit/0900a489213d74feb86fc0b343308fe7884a2a3c From a brief inspection, it appears as though zeromq and zeromq 3 in Fedora may not be affected.
In the version zeromq3-3.2.4-1.el6.src.rpm from EPEL, this -doesnt- even seem to mention the word nonce, or have any curve_client.cpp file, so I'm going to say that 1.2 its not effected by this issue, i'm not sure about 1.3
Statement: This issue did not affect the versions of zeromq as shipped with Inktank Ceph Enterprise 1.2 and 1.3.
The fedora 20 release zeromq3-3.2.4-1.fc20.src.rpm ,is the same release that was audited by the inktank developers found to be not affected by this issue.