Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 4 |
CVE-ID | CVE-2024-24568 CVE-2024-23839 CVE-2024-23836 CVE-2024-23835 |
CWE-ID | CWE-20 CWE-416 CWE-400 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Suricata Server applications / IDS/IPS systems, Firewalls and proxy servers |
Vendor | Open Information Security Foundation |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
EUVDB-ID: #VU87829
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-24568
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input when handling HTTP2 headers. A remote attacker can use specially crafted HTTP/2 requests to bypass existing ruleset.
Install updates from vendor's website.
Vulnerable software versionsSuricata: 7.0.0 - 7.0.2
External linkshttp://github.com/OISF/suricata/security/advisories/GHSA-gv29-5hqw-5h8c
http://github.com/OISF/suricata/commit/478a2a38f54e2ae235f8486bff87d7d66b6307f0
http://redmine.openinfosecfoundation.org/issues/6717
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU87828
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-23839
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error when handling HTTP traffic. A remote attacker can send specially crafted data to the system and perform a denial of service (DoS) attack.
Successful exploitation of the vulnerability requires that http.request_header or http.response_header keywords are used if the ruleset.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSuricata: 7.0.0 - 7.0.2
External linkshttp://github.com/OISF/suricata/security/advisories/GHSA-qxj6-hr2p-mmc7
http://github.com/OISF/suricata/commit/cd731fcaf42e5f7078c9be643bfa0cee2ad53e8f
http://redmine.openinfosecfoundation.org/issues/6657
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU87827
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-23836
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSuricata: 6.0.0 - 7.0.2
External linkshttp://github.com/OISF/suricata/security/advisories/GHSA-q33q-45cr-3cpc
http://github.com/OISF/suricata/commit/18841a58da71e735ddf4e52cbfa6989755ecbeb7
http://github.com/OISF/suricata/commit/2a2120ecf10c5b5713ec2bf59469fe57f7b5b747
http://github.com/OISF/suricata/commit/83c5567ea7b0b28376f57dcfee9c6301448c7bc7
http://github.com/OISF/suricata/commit/8efaebe293e2a74c8e323fa85a6f5fadf82801bc
http://github.com/OISF/suricata/commit/97953998d2d60673ed6c30ddfb6a2d59b4230f97
http://github.com/OISF/suricata/commit/b1549e930f6426eeff43f12b672337cbcda566b8
http://github.com/OISF/suricata/commit/cd035d59e3df157b606f4fe67324ea8e437be786
http://github.com/OISF/suricata/commit/ce9b90326949c94a46611d6394e28600ee5e8bd5
http://github.com/OISF/suricata/commit/e7e28822f473320658d6125f16ac3f0524baff01
http://github.com/OISF/suricata/commit/f9de1cca6182e571f1c02387dca6e695e55608af
http://redmine.openinfosecfoundation.org/issues/6531
http://redmine.openinfosecfoundation.org/issues/6532
http://redmine.openinfosecfoundation.org/issues/6540
http://redmine.openinfosecfoundation.org/issues/6658
http://redmine.openinfosecfoundation.org/issues/6659
http://redmine.openinfosecfoundation.org/issues/6660
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU87826
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-23835
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources during pgsql parsing. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSuricata: 7.0.0 - 7.0.2
External linkshttp://github.com/OISF/suricata/security/advisories/GHSA-8583-353f-mvwc
http://github.com/OISF/suricata/commit/86de7cffa7e8f06fe9d600127e7dabe89c7e81dd
http://github.com/OISF/suricata/commit/f52c033e566beafb4480c139eb18662a2870464f
http://redmine.openinfosecfoundation.org/issues/6411
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.