Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2024-37151

Suricata defrag: IP ID reuse can lead to policy bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OISF suricata

  • >= 6.0.0, < 6.0.20affected
  • >= 7.0.0,< 7.0.6affected

References