CVE-2024-28870

NameCVE-2024-28870
DescriptionSuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. When parsing an overly long SSH banner, Suricata can use excessive CPU resources, as well as cause excessive logging volume in alert records. This issue has been patched in versions 6.0.17 and 7.0.4.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
suricata (PTS)bullseye1:6.0.1-3vulnerable
bookworm1:6.0.10-1vulnerable
sid, trixie1:7.0.6-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
suricatasource(unstable)1:7.0.4-1

Notes

[bookworm] - suricata <no-dsa> (Minor issue)
[bullseye] - suricata <no-dsa> (Minor issue)
https://github.com/OISF/suricata/security/advisories/GHSA-mhhx-xw7r-r5c8
https://redmine.openinfosecfoundation.org/issues/6800
https://redmine.openinfosecfoundation.org/issues/6801

Search for package or bug name: Reporting problems