[PATCH] suricata: Update to 7.0.6

[PATCH] suricata: Update to 7.0.6

[Matthias Fischer]

[-- Attachment #1: Type: text/plain, Size: 3856 bytes --]

Excerpt from changelog:
"7.0.6 -- 2024-06-26

Security #7042: defrag: id reuse can lead to invalid reassembly (7.0.x backport)(CVE 2024-37151)
Security #7105: http2: oom from duplicate headers (7.0.x backport)
Security #7033: http/range: segv when http.memcap is reached (7.0.x backport)
Security #6988: modbus: txs without responses are never freed (7.0.x backport)
Bug #7107: packet: app-layer-events incorrectly used on recycled packets (7.0.x backport)
Bug #7064: util/radix-tree: Possible dereference of nullptr in case of unsuccess allocation of memory for node (7.0.x backport)
Bug #7063: smtp/mime: data command rejected by pipelining server does not reset data mode (7.0.x backport)
Bug #7060: smtp: split name logged as 2 names (7.0.x backport)
Bug #7050: af-packet: failure to start up on many threads plus high load (7.0.x backport)
Bug #7043: Crasher in HTTP chunked / StreamingBuffer (7.0.x backport)
Bug #7038: pcap/log: MacOS rotates file well before limit is reached (7.0.x backport)
Bug #7035: time: in offline mode, time can stay behind at pcap start (7.0.x backport)
Bug #7023: unix-socket: iface-bypassed-stat crash (7.0.x backport)
Bug #7021: unix-socket: hostbit commands don't properly release host (7.0.x backport)
Bug #7015: rust: build with rust 1.78 with slice::from_raw_parts now requiring the pointer to be non-null (7.0.x backport)
Bug #6990: tls.random buffers don't work as expected (7.0.x backport)
Bug #6986: iprep: rule with '=,0' can't match (7.0.x backport)
Bug #6975: detect: log relevant frames app-layer metdata (7.0.x backport)
Bug #6950: decode/ppp: decoder.event.ppp.wrong_type on valid packet (7.0.x backport)
Bug #6897: detect/port: upper boundary ports are not correctly handled (7.0.x backport)
Bug #6895: detect/port: port grouping does not happen correctly if gap between a single and range port (7.0.x backport)
Bug #6862: Lightweight rules profiling: crash when profiling ends (7.0.x backport)
Bug #6848: alerts: wrongly using tx id 0 when there is no tx (7.0.x backport)
Bug #6845: coverity: warning in port grouping code (7.0.x backport)
Bug #6844: detect/port: port ranges are incorrect when a port is single as well as a part of range (7.0.x backport)
Bug #6690: Ethernet src should match src ip (7.0.x backport)
Bug #6520: detect-engine/port: recursive DetectPortInsert calls are expensive (7.0.x backport)
Optimization #6830: detect/port: port grouping is quite slow in worst cases (7.0.x backport)
Optimization #6829: detect/port: PortGroupWhitelist fn takes a lot of processing time (7.0.x backport)
Feature #7010: JA4 support for TLS and QUIC (7.0.x backport)
Feature #6557: Capability to have rules profiling on pcap run (7.0.x backport)
Documentation #6910: userguide: document how to verify tar.gz signature (7.0.x backport)
Documentation #6687: docs: port userguide build instruction changes from master-6.0.x (7.0.x backport)
Documentation #6601: docs: update eBPF installation instructions (7.0.x backport)"

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
---
 lfs/suricata | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/suricata b/lfs/suricata
index a987fc520..88f3c4575 100644
--- a/lfs/suricata
+++ b/lfs/suricata
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 7.0.5
+VER        = 7.0.6
 
 THISAPP    = suricata-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 9a44e4561edcc8909853b88779aa520a79b684ca9114479a95b2b34f8e34b6a0f5887d4b332dddb9da225335d7642089345e7f245a1ebce68f42f38126eb4b58
+$(DL_FILE)_BLAKE2 = e031eda35913f0db553ae68e6fc4173db2f0a87b2f2c60141edf09abba3eef44cdba6cca1db039c8814525ff803dd60ea13cbba7b66e57fed3ae5297f90c7b18
 
 install : $(TARGET)
 
-- 
2.34.1

Re: [PATCH] suricata: Update to 7.0.6

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 4199 bytes --]

Thank you very much for upgrading this so urgently :)

-Michael

Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>

> On 28 Jun 2024, at 09:32, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote:
> 
> Excerpt from changelog:
> "7.0.6 -- 2024-06-26
> 
> Security #7042: defrag: id reuse can lead to invalid reassembly (7.0.x backport)(CVE 2024-37151)
> Security #7105: http2: oom from duplicate headers (7.0.x backport)
> Security #7033: http/range: segv when http.memcap is reached (7.0.x backport)
> Security #6988: modbus: txs without responses are never freed (7.0.x backport)
> Bug #7107: packet: app-layer-events incorrectly used on recycled packets (7.0.x backport)
> Bug #7064: util/radix-tree: Possible dereference of nullptr in case of unsuccess allocation of memory for node (7.0.x backport)
> Bug #7063: smtp/mime: data command rejected by pipelining server does not reset data mode (7.0.x backport)
> Bug #7060: smtp: split name logged as 2 names (7.0.x backport)
> Bug #7050: af-packet: failure to start up on many threads plus high load (7.0.x backport)
> Bug #7043: Crasher in HTTP chunked / StreamingBuffer (7.0.x backport)
> Bug #7038: pcap/log: MacOS rotates file well before limit is reached (7.0.x backport)
> Bug #7035: time: in offline mode, time can stay behind at pcap start (7.0.x backport)
> Bug #7023: unix-socket: iface-bypassed-stat crash (7.0.x backport)
> Bug #7021: unix-socket: hostbit commands don't properly release host (7.0.x backport)
> Bug #7015: rust: build with rust 1.78 with slice::from_raw_parts now requiring the pointer to be non-null (7.0.x backport)
> Bug #6990: tls.random buffers don't work as expected (7.0.x backport)
> Bug #6986: iprep: rule with '=,0' can't match (7.0.x backport)
> Bug #6975: detect: log relevant frames app-layer metdata (7.0.x backport)
> Bug #6950: decode/ppp: decoder.event.ppp.wrong_type on valid packet (7.0.x backport)
> Bug #6897: detect/port: upper boundary ports are not correctly handled (7.0.x backport)
> Bug #6895: detect/port: port grouping does not happen correctly if gap between a single and range port (7.0.x backport)
> Bug #6862: Lightweight rules profiling: crash when profiling ends (7.0.x backport)
> Bug #6848: alerts: wrongly using tx id 0 when there is no tx (7.0.x backport)
> Bug #6845: coverity: warning in port grouping code (7.0.x backport)
> Bug #6844: detect/port: port ranges are incorrect when a port is single as well as a part of range (7.0.x backport)
> Bug #6690: Ethernet src should match src ip (7.0.x backport)
> Bug #6520: detect-engine/port: recursive DetectPortInsert calls are expensive (7.0.x backport)
> Optimization #6830: detect/port: port grouping is quite slow in worst cases (7.0.x backport)
> Optimization #6829: detect/port: PortGroupWhitelist fn takes a lot of processing time (7.0.x backport)
> Feature #7010: JA4 support for TLS and QUIC (7.0.x backport)
> Feature #6557: Capability to have rules profiling on pcap run (7.0.x backport)
> Documentation #6910: userguide: document how to verify tar.gz signature (7.0.x backport)
> Documentation #6687: docs: port userguide build instruction changes from master-6.0.x (7.0.x backport)
> Documentation #6601: docs: update eBPF installation instructions (7.0.x backport)"
> 
> Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
> ---
> lfs/suricata | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/lfs/suricata b/lfs/suricata
> index a987fc520..88f3c4575 100644
> --- a/lfs/suricata
> +++ b/lfs/suricata
> @@ -24,7 +24,7 @@
> 
> include Config
> 
> -VER        = 7.0.5
> +VER        = 7.0.6
> 
> THISAPP    = suricata-$(VER)
> DL_FILE    = $(THISAPP).tar.gz
> @@ -40,7 +40,7 @@ objects = $(DL_FILE)
> 
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
> 
> -$(DL_FILE)_BLAKE2 = 9a44e4561edcc8909853b88779aa520a79b684ca9114479a95b2b34f8e34b6a0f5887d4b332dddb9da225335d7642089345e7f245a1ebce68f42f38126eb4b58
> +$(DL_FILE)_BLAKE2 = e031eda35913f0db553ae68e6fc4173db2f0a87b2f2c60141edf09abba3eef44cdba6cca1db039c8814525ff803dd60ea13cbba7b66e57fed3ae5297f90c7b18
> 
> install : $(TARGET)
> 
> -- 
> 2.34.1
> 

Re: [PATCH] suricata: Update to 7.0.6

[Matthias Fischer]

[-- Attachment #1: Type: text/plain, Size: 5198 bytes --]

Hi,

no problem...running here under Core 186 since yesterday with no seen
problems. ;-)

Btw, just in case "someone" didn't see it, there's still something "in
the queue":

squid 6.10:
https://patchwork.ipfire.org/project/ipfire/patch/20240612160650.3445393-1-matthias.fischer(a)ipfire.org/

bind 9.16.50 (last version, EOL):
https://patchwork.ipfire.org/project/ipfire/patch/20240625223931.3431187-1-matthias.fischer(a)ipfire.org/

nano 8.0:
https://patchwork.ipfire.org/project/ipfire/patch/20240626153518.3404591-1-matthias.fischer(a)ipfire.org/

monit 5.34.0:
https://patchwork.ipfire.org/project/ipfire/patch/20240530115423.3450882-1-matthias.fischer(a)ipfire.org/

ntp 4.2.8p18:
https://patchwork.ipfire.org/project/ipfire/patch/20240526153432.3740128-1-matthias.fischer(a)ipfire.org/

All running here - no problems.

Best
Matthias

On 28.06.2024 10:57, Michael Tremer wrote:
> Thank you very much for upgrading this so urgently :)
> 
> -Michael
> 
> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
> 
>> On 28 Jun 2024, at 09:32, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote:
>> 
>> Excerpt from changelog:
>> "7.0.6 -- 2024-06-26
>> 
>> Security #7042: defrag: id reuse can lead to invalid reassembly (7.0.x backport)(CVE 2024-37151)
>> Security #7105: http2: oom from duplicate headers (7.0.x backport)
>> Security #7033: http/range: segv when http.memcap is reached (7.0.x backport)
>> Security #6988: modbus: txs without responses are never freed (7.0.x backport)
>> Bug #7107: packet: app-layer-events incorrectly used on recycled packets (7.0.x backport)
>> Bug #7064: util/radix-tree: Possible dereference of nullptr in case of unsuccess allocation of memory for node (7.0.x backport)
>> Bug #7063: smtp/mime: data command rejected by pipelining server does not reset data mode (7.0.x backport)
>> Bug #7060: smtp: split name logged as 2 names (7.0.x backport)
>> Bug #7050: af-packet: failure to start up on many threads plus high load (7.0.x backport)
>> Bug #7043: Crasher in HTTP chunked / StreamingBuffer (7.0.x backport)
>> Bug #7038: pcap/log: MacOS rotates file well before limit is reached (7.0.x backport)
>> Bug #7035: time: in offline mode, time can stay behind at pcap start (7.0.x backport)
>> Bug #7023: unix-socket: iface-bypassed-stat crash (7.0.x backport)
>> Bug #7021: unix-socket: hostbit commands don't properly release host (7.0.x backport)
>> Bug #7015: rust: build with rust 1.78 with slice::from_raw_parts now requiring the pointer to be non-null (7.0.x backport)
>> Bug #6990: tls.random buffers don't work as expected (7.0.x backport)
>> Bug #6986: iprep: rule with '=,0' can't match (7.0.x backport)
>> Bug #6975: detect: log relevant frames app-layer metdata (7.0.x backport)
>> Bug #6950: decode/ppp: decoder.event.ppp.wrong_type on valid packet (7.0.x backport)
>> Bug #6897: detect/port: upper boundary ports are not correctly handled (7.0.x backport)
>> Bug #6895: detect/port: port grouping does not happen correctly if gap between a single and range port (7.0.x backport)
>> Bug #6862: Lightweight rules profiling: crash when profiling ends (7.0.x backport)
>> Bug #6848: alerts: wrongly using tx id 0 when there is no tx (7.0.x backport)
>> Bug #6845: coverity: warning in port grouping code (7.0.x backport)
>> Bug #6844: detect/port: port ranges are incorrect when a port is single as well as a part of range (7.0.x backport)
>> Bug #6690: Ethernet src should match src ip (7.0.x backport)
>> Bug #6520: detect-engine/port: recursive DetectPortInsert calls are expensive (7.0.x backport)
>> Optimization #6830: detect/port: port grouping is quite slow in worst cases (7.0.x backport)
>> Optimization #6829: detect/port: PortGroupWhitelist fn takes a lot of processing time (7.0.x backport)
>> Feature #7010: JA4 support for TLS and QUIC (7.0.x backport)
>> Feature #6557: Capability to have rules profiling on pcap run (7.0.x backport)
>> Documentation #6910: userguide: document how to verify tar.gz signature (7.0.x backport)
>> Documentation #6687: docs: port userguide build instruction changes from master-6.0.x (7.0.x backport)
>> Documentation #6601: docs: update eBPF installation instructions (7.0.x backport)"
>> 
>> Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
>> ---
>> lfs/suricata | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>> 
>> diff --git a/lfs/suricata b/lfs/suricata
>> index a987fc520..88f3c4575 100644
>> --- a/lfs/suricata
>> +++ b/lfs/suricata
>> @@ -24,7 +24,7 @@
>> 
>> include Config
>> 
>> -VER        = 7.0.5
>> +VER        = 7.0.6
>> 
>> THISAPP    = suricata-$(VER)
>> DL_FILE    = $(THISAPP).tar.gz
>> @@ -40,7 +40,7 @@ objects = $(DL_FILE)
>> 
>> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>> 
>> -$(DL_FILE)_BLAKE2 = 9a44e4561edcc8909853b88779aa520a79b684ca9114479a95b2b34f8e34b6a0f5887d4b332dddb9da225335d7642089345e7f245a1ebce68f42f38126eb4b58
>> +$(DL_FILE)_BLAKE2 = e031eda35913f0db553ae68e6fc4173db2f0a87b2f2c60141edf09abba3eef44cdba6cca1db039c8814525ff803dd60ea13cbba7b66e57fed3ae5297f90c7b18
>> 
>> install : $(TARGET)
>> 
>> -- 
>> 2.34.1
>> 
>