CVE-2024-47187

Name	CVE-2024-47187
Description	Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
suricata (PTS)	jessie, jessie (lts)	2.0.7-2+deb8u5	vulnerable
	stretch	3.2.1-1+deb9u1	vulnerable
	buster, buster (lts)	1:4.1.2-2+deb10u2	vulnerable
	bullseye	1:6.0.1-3	vulnerable
	bookworm	1:6.0.10-1	vulnerable
	sid, trixie	1:7.0.8-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
suricata	source	jessie	(unfixed)	end-of-life
suricata	source	stretch	(unfixed)	end-of-life
suricata	source	(unstable)	1:7.0.7-1

Notes

[bookworm] - suricata <no-dsa> (Minor issue)
[bullseye] - suricata <postponed> (Minor issue; can be fixed in next update)
https://github.com/OISF/suricata/security/advisories/GHSA-64ww-4f6x-863p
https://redmine.openinfosecfoundation.org/issues/7209
[buster] - suricata <postponed> (Minor issue)