CVE-2024-28870

NameCVE-2024-28870
DescriptionSuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. When parsing an overly long SSH banner, Suricata can use excessive CPU resources, as well as cause excessive logging volume in alert records. This issue has been patched in versions 6.0.17 and 7.0.4.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
suricata (PTS)jessie, jessie (lts)2.0.7-2+deb8u5vulnerable
stretch3.2.1-1+deb9u1vulnerable
buster, buster (lts)1:4.1.2-2+deb10u2vulnerable
bullseye1:6.0.1-3vulnerable
bookworm1:6.0.10-1vulnerable
sid, trixie1:7.0.8-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
suricatasourcejessie(unfixed)end-of-life
suricatasourcestretch(unfixed)end-of-life
suricatasource(unstable)1:7.0.4-1

Notes

[bookworm] - suricata <no-dsa> (Minor issue)
[bullseye] - suricata <no-dsa> (Minor issue)
https://github.com/OISF/suricata/security/advisories/GHSA-mhhx-xw7r-r5c8
https://redmine.openinfosecfoundation.org/issues/6800
https://redmine.openinfosecfoundation.org/issues/6801
[buster] - suricata <postponed> (Minor issue)

Search for package or bug name: Reporting problems