From patchwork Tue Sep 15 16:04:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 10227 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hkn0L0kb3z3wr7 for ; Tue, 15 Sep 2026 16:04:50 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hkn0J4fd6z6lW for ; Tue, 15 Sep 2026 16:04:48 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hkn0D6gQ2z36W8 for ; Tue, 15 Sep 2026 16:04:44 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hkn0B28rHz2xHh for ; Tue, 15 Sep 2026 16:04:42 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hkn084Cyrzsm; Tue, 15 Sep 2026 16:04:40 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1789488280; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=9hO+0izXe+xKr1Cl1xCq+uIyJ2ek+p9iLL40HpdrLn0=; b=gThAjUdFXeb+o6RSYCstfuZ9tfLb4Hjmuck6r/7U59E/WTSYDKuwcL3MjKTJP2iJ/HR043 IIqF+UeSt5d4Y/Dw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1789488280; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=9hO+0izXe+xKr1Cl1xCq+uIyJ2ek+p9iLL40HpdrLn0=; b=dzBeCm4gymqyL30rxOZd4RpkeTOGfPQXqKLGnoxipQVtmkM0LaGlX9oSF7naY97rHn/Bvz Cjqg2/NgrmCzx3tbZE0TRN+F2CuM4Bx2MOayi7x8OmzENi31gz1HGirzfZ6PpvJjpcdijt GOzfxpYbwDSt26XS7hZNpDVpls0vlP9Eq+SXhZlBJmPQdeL/O8v5gQ/5a9IcFU0hGrZJHn 5ySPOu7FOkQrCwHJvW4Dq6DYFnNsLStrMuUWlim8a9RzHWMt0TUE4l3RQyTZx2attqHcIw 10ZkDN/7UcBhdCwRkB6M6sCt2VFhKiOuYATUIVMCNOnJaiQh/yJHwUclWDFfIw== From: Matthias Fischer To: development@lists.ipfire.org Cc: Matthias Fischer Subject: [PATCH] suricata: Update to 8.0.7 Date: Tue, 15 Sep 2026 18:04:29 +0200 Message-ID: <20260915160431.161504-1-matthias.fischer@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 For details see: https://redmine.openinfosecfoundation.org/versions/236 Excerpt from changelog: "8.0.7 -- 2026-09-13 Security #9002: lua/hashlib: use after free when using gc (8.0.x backport) Security #8881: lua/hashlib: null dereference attempting to use hash after finalize call (8.0.x backport) Security #8801: ike: memory exhaustion from unbounded recursion (8.0.x backport) Security #8982: dnp3: link-layer events before first transaction are dropped (8.0.x backport) Security #8938: dhcp: detection bypass parsing DHCP Pad option (code 0) (8.0.x backport) Security #8922: detect/inspect: infinite loop with too large response-body-limit and stream.reassembly.depth (8.0.x backport) Security #8971: pgsql: detection bypass post gap recovery (8.0.x backport) Security #8870: htp: unbounded memory exhaustion in logging (8.0.x backport) Security #8769: datasets: buffer overread with too small hashes (8.0.x backport) Security #8930: detect: heap OOB read on byte_test with nbytes from byte_extract/byte_math (8.0.x backport) Security #8909: ftp: global memuse counter leak (8.0.x backport) Security #8986: rdp: detection bypass due to infinite loop in MCS/CS processing T.123 TPKT payload (8.0.x backport) Security #8947: htp: detection bypass of files due to mishandling of FHCRC field by gzip decompressor (8.0.x backport) Security #9000: jsonbuilder: exposed endpoints for JSON injection (8.0.x backport) Security #8981: dnp3: framing errors stop transaction inspection for the flow (8.0.x backport) Security #8732: rfb: too long strings can cause log flooding (8.0.x backport) Security #8877: dnp3: DoS via huge fixed-size object structs like G70Vx/G120Vx (8.0.x backport) Security #8794: ldap: unbounded recursion in ldap-parser crate (8.0.x backport) Security #8937: tls: detection bypass due to X.509 SubjectAltName count truncation (8.0.x backport) Security #8921: pcap/log: heap out-of-bounds read with oversized TCP packets (8.0.x backport) Security #8965: http2: Host-only requests bypass host inspection and inline policy (8.0.x backport) Security #8810: enip: parser bypass with tcp data splicing (8.0.x backport) Security #8758: enip: quadratic complexity in parse_cip_reqresp_multiple (8.0.x backport) Security #8985: swf: excessive memory allocation from attacker controlled traffic (8.0.x backport) Security #8927: ssl: integer underflow due to miscalculation in SSLv2 CLIENT_HELLO (8.0.x backport) Security #8906: lua: type mismatch crashes Suricata (8.0.x backport) Security #8998: defrag: fragments bypass the layer limit and exhaust the worker stack (8.0.x backport) Security #8946: http2: parser desync on HEADERS frame without END_HEADERS flag (8.0.x backport) Security #8977: ike: detection bypass in case of invalid major version in header (8.0.x backport) Security #8677: pgsql: unbounded backend responses (8.0.x backport) Security #9009: http: brotli compression bomb (8.0.x backport) Security #8875: defrag/ipv6: detection bypass due to integer overflow (8.0.x backport) Security #8792: nfs: unbounded read/write data queuing (8.0.x backport) Security #8933: detect: heap OOB read on byte_test with nbytes from a runtime variable (8.0.x backport) Security #8920: doh: dns inspection uses the wrong transaction for progress (8.0.x backport) Security #8963: http2: IPv6 authority truncation bypasses normalized host policy (8.0.x backport) Security #8984: detect/file: detection bypass with multiple file keywords on a transaction (8.0.x backport) Security #8808: lua/datasets: heap OOB due to improper string length handling (8.0.x backport) Security #8756: http2: unbounded dynamic table growith with header size update (8.0.x backport) Security #8989: pgsql: row_description/consolidated_data_row never reconciled against msg length (8.0.x backport) Security #8925: lua/flowvar: heap buffer overflow with unverified length (8.0.x backport) Security #8898: lua/dns: heap buffer overflow due to unbounded Lua stack (8.0.x backport) Security #8945: flow: ESP SPI omission from flow hash (8.0.x backport) Security #9005: swf: unlimited decompress-depth leads to detection bypass due to truncated buffer (8.0.x backport) Security #8872: smtp: NULL pointer deref on MIME processing if internal file malloc fails (8.0.x backport) Security #8790: smb1: unbounded read/write data queuing (8.0.x backport) Security #8932: output: remote DoS with tcp-data/http-body-data in case of file handling errors (8.0.x backport) Security #8913: detect/tx: heap buffer overflow with post-rule-match prefilter (8.0.x backport) Security #8957: threshold: decision cache can grow without bound and terminate Suricata (8.0.x backport) Security #8746: lua/smtp: infinite loop in get_mime_list (8.0.x backport) Security #8988: ftp: lines following an over-long command or reply in the same stream slice are never parsed (8.0.x backport) Security #8983: stream: inspection bypass due to erroneous wiping of TCP session flags (8.0.x backport) Security #8806: lua: sandbox memory limit bypass (8.0.x backport) Security #8751: nfs: v3 READ attr_follows=0 file-data inspection bypass (8.0.x backport) Security #8924: nfs: detection bypass due to incorrect handling of SECINFO_NO_NAME (8.0.x backport) Security #8883: dns: detection bypass at resync post gap (8.0.x backport) Security #9004: detect/http2: use after free with http.request_header keyword (8.0.x backport) Security #9013: pgsql: JSON corruption with crafted malicious traffic (8.0.x backport) Security #8972: pgsql: unbound Copy Responses lead to parser desync (8.0.x backport) Security #8941: mqtt: memory exhaustion due to unbounded unknown property parsing (8.0.x backport) Security #8871: detect: abrupt termination if a pcre flowvar capture matches on a packet with no flow (8.0.x backport) Security #8788: http2: header detection bypass due to wrong padding handling (8.0.x backport) Security #8931: datasets: bypass of save/state paths sandbox on Windows (8.0.x backport) Security #8910: ftp: invalid command buffer after long line truncation (8.0.x backport) Security #8974: detect: DoS due to type confused free upgrading protocols http1 to http2 to doh2 (8.0.x backport) Security #8950: ldap: detection bypass at resync post gap (8.0.x backport) Security #8987: ssh: miscalculation due to oversized KEXINIT causes parser desync (8.0.x backport) Bug #9035: sip: protocol detection incorrectly matches ssdp traffic (8.0.x backport) Bug #9033: threads: fix pthread attribute leak in TmThreadSpawn (8.0.x backport) Bug #9024: pgsql: use message type for transaction actions (8.0.x backport) Bug #9018: output: Double-free of prefix/sensor_name in threaded LogFileCtx teardown (8.0.x backport) Bug #9017: erf/file: ERF PAD and META type records and extension headers are not supported (8.0.x backport) Bug #9016: erf/file: sets packet length from unvalidated wlen, causing OOB heap read in decoder (8.0.x backport) Bug #9015: erf/file: Heap buffer overflow in ERF file reader via untrusted rlen field (8.0.x backport) Bug #9014: util: undefined behavior in fallback memrchr implementation (8.0.x backport) Bug #9011: detect: NULL deref in alert output when reference keyword uses undefined key (8.0.x backport) Bug #8996: smtp: rejected BDAT reply leaves parser in data mode (8.0.x backport) Bug #8976: unwind: OOB write in case of deep call stack (8.0.x backport) Bug #8955: firewall: action scope not validated when inherited in multi-action rules (8.0.x backport) Bug #8952: engine-analysis: packet:filter policy is hardcoded to drop:packet (8.0.x backport) Bug #8942: setting variables with --set leads to segfault (8.0.x backport) Bug #8936: dhcp: parser never reports malformed options (8.0.x backport) Bug #8935: dhcp: parser ignores the declared length of time options (8.0.x backport) Bug #8934: nfs: large attacker-controlled memory allocation parsing NFSv4 LAYOUTGET reply (8.0.x backport) Bug #8929: reject: DoS by non-Ethernet capture packet in autofp mode due to stale context caching (8.0.x backport) Bug #8928: smb1: unbounded vector growth in NEGOTIATE dialect list (8.0.x backport) Bug #8926: tls: use-after-free of JA3 elliptic-curve buffers on malloc failure (8.0.x backport) Bug #8923: stream: SIGSEGV in SYN queue rotation helper (8.0.x backport) Bug #8912: frame: incorrect debug assertion triggered (8.0.x backport) Bug #8911: flow/rate: underflow due to incorrect flushing of the ring (8.0.x backport) Bug #8902: detect: undefined behavior on OOB rvalue with byte_math (8.0.x backport) Bug #8901: detect/iponly: detection bypass with ipv6 ranges (8.0.x backport) Bug #8876: smtp: complete BDAT transactions at LAST (8.0.x backport) Bug #8869: ippair: Memory leak caused by ippair processing (8.0.x backport) Bug #8868: expectations: IPPair mutex/reference leak on malloc failure (8.0.x backport) Bug #8804: dag: Infinite loop in DAG record processing when rlen < dag_record_size (8.0.x backport) Bug #8796: tls: incorrect looping logic leads to extensions pollution (8.0.x backport) Bug #8773: defrag: memuse reported incorrectly (8.0.x backport) Bug #8765: smtp: assertion on DATA reply without owning transaction (8.0.x backport) Bug #8761: http2: content-encoding are case insensitive (8.0.x backport) Bug #8730: smtp: trailing quit can create an empty transaction (8.0.x backport) Bug #8716: smtp: subsequent helo/ehlo should be treated like a rset (8.0.x backport) Bug #8706: util/file: fix integer overflow in file inspection window comparison (8.0.x backport) Bug #8705: af-packet: eBPF map location error never printed (8.0.x backport) Bug #8618: threshold: seed only partially applied in IPv6 hash (8.0.x backport) Bug #8474: flow: bypass manager checks for initializer instead of actual fn (8.0.x backport) Bug #8314: firewall: rule language can't accept ARP (8.0.x) Optimization #8786: mqtt: eve json corruption by crafted traffic (8.0.x backport) Feature #9019: firewall: allow single packet rule to accept tcp connection (8.0.x backport) Feature #8904: firewall: support SMTP hook states for firewall rule evaluation (8.0.x backport) Feature #8879: datasets: add support for subdomain match (8.0.x backport) Feature #8770: firewall: add default app policy options (8.0.x backport) Feature #8729: firewall: allow single rule to accept protocol detection in progress and the final protocol (8.0.x backport) Task #8688: psl: crate should be updated on every release (8.0.x backport) Documentation #8345: doc: update Rust install instructions (8.0.x backport)" Signed-off-by: Matthias Fischer --- lfs/suricata | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/suricata b/lfs/suricata index 018209bac..d671d8596 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 8.0.6 +VER = 8.0.7 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 37ceed6b6ac608df628bda315f2e864d82424b66d6e8e64e1b7cebcb306fe90679b0ca2a19f0be98274aaade5d0c6986619182c56a353b93d71bce9d58892f19 +$(DL_FILE)_BLAKE2 = eb6bda943779f0353a74aa8d783c037f3f08ab311a679962b0742df57c37e2d926a37002085dbff3463212f708f9baf128c4dc15905a0a42458c8a69bcea9e30 install : $(TARGET)