CVE-2024-23839

Name	CVE-2024-23839
Description	Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially crafted traffic can cause a heap use after free if the ruleset uses the http.request_header or http.response_header keyword. The vulnerability has been patched in 7.0.3. To work around the vulnerability, avoid the http.request_header and http.response_header keywords.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
suricata (PTS)	bullseye	1:6.0.1-3	fixed
	bullseye (security)	1:6.0.1-3+deb11u1	fixed
	trixie	1:7.0.10-1+deb13u4	fixed
	forky, sid	1:8.0.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
suricata	source	buster	(not affected)
suricata	source	bullseye	(not affected)
suricata	source	(unstable)	1:7.0.3-1

Notes

[bullseye] - suricata <not-affected> (Vulnerable code not present)
[buster] - suricata <not-affected> (Vulnerable code not present)
https://github.com/OISF/suricata/security/advisories/GHSA-qxj6-hr2p-mmc7
https://github.com/OISF/suricata/commit/cd731fcaf42e5f7078c9be643bfa0cee2ad53e8f (suricata-7.0.3)
https://redmine.openinfosecfoundation.org/issues/6657