From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthias Fischer To: development@lists.ipfire.org Subject: Re: [PATCH] suricata: Update to 7.0.6 Date: Fri, 28 Jun 2024 11:57:33 +0200 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0049966617445123229==" List-Id: --===============0049966617445123229== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, no problem...running here under Core 186 since yesterday with no seen problems. ;-) Btw, just in case "someone" didn't see it, there's still something "in the queue": squid 6.10: https://patchwork.ipfire.org/project/ipfire/patch/20240612160650.3445393-1-ma= tthias.fischer(a)ipfire.org/ bind 9.16.50 (last version, EOL): https://patchwork.ipfire.org/project/ipfire/patch/20240625223931.3431187-1-ma= tthias.fischer(a)ipfire.org/ nano 8.0: https://patchwork.ipfire.org/project/ipfire/patch/20240626153518.3404591-1-ma= tthias.fischer(a)ipfire.org/ monit 5.34.0: https://patchwork.ipfire.org/project/ipfire/patch/20240530115423.3450882-1-ma= tthias.fischer(a)ipfire.org/ ntp 4.2.8p18: https://patchwork.ipfire.org/project/ipfire/patch/20240526153432.3740128-1-ma= tthias.fischer(a)ipfire.org/ All running here - no problems. Best Matthias On 28.06.2024 10:57, Michael Tremer wrote: > Thank you very much for upgrading this so urgently :) >=20 > -Michael >=20 > Reviewed-by: Michael Tremer >=20 >> On 28 Jun 2024, at 09:32, Matthias Fischer = wrote: >>=20 >> Excerpt from changelog: >> "7.0.6 -- 2024-06-26 >>=20 >> Security #7042: defrag: id reuse can lead to invalid reassembly (7.0.x bac= kport)(CVE 2024-37151) >> Security #7105: http2: oom from duplicate headers (7.0.x backport) >> Security #7033: http/range: segv when http.memcap is reached (7.0.x backpo= rt) >> Security #6988: modbus: txs without responses are never freed (7.0.x backp= ort) >> Bug #7107: packet: app-layer-events incorrectly used on recycled packets (= 7.0.x backport) >> Bug #7064: util/radix-tree: Possible dereference of nullptr in case of uns= uccess allocation of memory for node (7.0.x backport) >> Bug #7063: smtp/mime: data command rejected by pipelining server does not = reset data mode (7.0.x backport) >> Bug #7060: smtp: split name logged as 2 names (7.0.x backport) >> Bug #7050: af-packet: failure to start up on many threads plus high load (= 7.0.x backport) >> Bug #7043: Crasher in HTTP chunked / StreamingBuffer (7.0.x backport) >> Bug #7038: pcap/log: MacOS rotates file well before limit is reached (7.0.= x backport) >> Bug #7035: time: in offline mode, time can stay behind at pcap start (7.0.= x backport) >> Bug #7023: unix-socket: iface-bypassed-stat crash (7.0.x backport) >> Bug #7021: unix-socket: hostbit commands don't properly release host (7.0.= x backport) >> Bug #7015: rust: build with rust 1.78 with slice::from_raw_parts now requi= ring the pointer to be non-null (7.0.x backport) >> Bug #6990: tls.random buffers don't work as expected (7.0.x backport) >> Bug #6986: iprep: rule with '=3D,0' can't match (7.0.x backport) >> Bug #6975: detect: log relevant frames app-layer metdata (7.0.x backport) >> Bug #6950: decode/ppp: decoder.event.ppp.wrong_type on valid packet (7.0.x= backport) >> Bug #6897: detect/port: upper boundary ports are not correctly handled (7.= 0.x backport) >> Bug #6895: detect/port: port grouping does not happen correctly if gap bet= ween a single and range port (7.0.x backport) >> Bug #6862: Lightweight rules profiling: crash when profiling ends (7.0.x b= ackport) >> Bug #6848: alerts: wrongly using tx id 0 when there is no tx (7.0.x backpo= rt) >> Bug #6845: coverity: warning in port grouping code (7.0.x backport) >> Bug #6844: detect/port: port ranges are incorrect when a port is single as= well as a part of range (7.0.x backport) >> Bug #6690: Ethernet src should match src ip (7.0.x backport) >> Bug #6520: detect-engine/port: recursive DetectPortInsert calls are expens= ive (7.0.x backport) >> Optimization #6830: detect/port: port grouping is quite slow in worst case= s (7.0.x backport) >> Optimization #6829: detect/port: PortGroupWhitelist fn takes a lot of proc= essing time (7.0.x backport) >> Feature #7010: JA4 support for TLS and QUIC (7.0.x backport) >> Feature #6557: Capability to have rules profiling on pcap run (7.0.x backp= ort) >> Documentation #6910: userguide: document how to verify tar.gz signature (7= .0.x backport) >> Documentation #6687: docs: port userguide build instruction changes from m= aster-6.0.x (7.0.x backport) >> Documentation #6601: docs: update eBPF installation instructions (7.0.x ba= ckport)" >>=20 >> Signed-off-by: Matthias Fischer >> --- >> lfs/suricata | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >>=20 >> diff --git a/lfs/suricata b/lfs/suricata >> index a987fc520..88f3c4575 100644 >> --- a/lfs/suricata >> +++ b/lfs/suricata >> @@ -24,7 +24,7 @@ >>=20 >> include Config >>=20 >> -VER =3D 7.0.5 >> +VER =3D 7.0.6 >>=20 >> THISAPP =3D suricata-$(VER) >> DL_FILE =3D $(THISAPP).tar.gz >> @@ -40,7 +40,7 @@ objects =3D $(DL_FILE) >>=20 >> $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) >>=20 >> -$(DL_FILE)_BLAKE2 =3D 9a44e4561edcc8909853b88779aa520a79b684ca9114479a95b= 2b34f8e34b6a0f5887d4b332dddb9da225335d7642089345e7f245a1ebce68f42f38126eb4b58 >> +$(DL_FILE)_BLAKE2 =3D e031eda35913f0db553ae68e6fc4173db2f0a87b2f2c60141ed= f09abba3eef44cdba6cca1db039c8814525ff803dd60ea13cbba7b66e57fed3ae5297f90c7b18 >>=20 >> install : $(TARGET) >>=20 >> --=20 >> 2.34.1 >>=20 >=20 --===============0049966617445123229==--