Suricata defrag: IP ID reuse can lead to policy bypass
Summary
Suricata defrag: IP ID reuse can lead to policy bypass
Original description
The description as published by the source.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.
Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable defrag to reduce the scope of the problem.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-37151 suricata Fixed in: 1:6.0.1-3+deb11u1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web lists.debian.org
- web redmine.openinfosecfoundation.org
- web redmine.openinfosecfoundation.org