Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OISF suricata
>= 8.0.0, < 8.0.6affected
References
- https://github.com/OISF/suricata/security/advisories/GHSA-prqx-q74v-wxhv ↗
- https://github.com/OISF/suricata/pull/15807 ↗
- https://github.com/OISF/suricata/commit/499995bf0e5eab34b647ec1024ce65d72c411816 ↗
- https://github.com/OISF/suricata/commit/6f87930aff1e2294e46289cb9cbf4d96d79a209a ↗
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 ↗
- https://redmine.openinfosecfoundation.org/issues/8582 ↗