git: 50d9f85ce609 - main - security/vuxml: Mark zeek < 5.0.3 as vulnerable as per:
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 09 Nov 2022 01:08:47 UTC
The branch main has been updated by leres:
URL: https://cgit.FreeBSD.org/ports/commit/?id=50d9f85ce609b05ce87cd233b9b355659698f435
commit 50d9f85ce609b05ce87cd233b9b355659698f435
Author: Craig Leres <leres@FreeBSD.org>
AuthorDate: 2022-11-09 01:08:16 +0000
Commit: Craig Leres <leres@FreeBSD.org>
CommitDate: 2022-11-09 01:08:16 +0000
security/vuxml: Mark zeek < 5.0.3 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v5.0.3
This release fixes the following potential DoS vulnerabilities:
- Fix an issue where a specially-crafted FTP packet can cause Zeek
to spend large amounts of time attempting to search for valid
commands in the data stream.
- Fix a possible overflow in the Zeek dictionary code that may
lead to a memory leak.
- Fix an issue where a specially-crafted packet can cause Zeek to
spend large amounts of time reporting analyzer violations.
- Fix a possible assert and crash in the HTTP analyzer when receiving
a specially-crafted packet.
- Fix an issue where a specially-crafted HTTP or SMTP packet can
cause Zeek to spend a large amount of time attempting to search
for filenames within the packet data.
- Fix two separate possible crashes when converting processed IP
headers for logging via the raw_packet event handlers.
This release fixes the following bugs:
- Fix a possible crash with when statements where lambda captures
of local variables sometimes overflowed the frame counter.
- Reduced the amount of analyzer_confirmation events that are
raised for packets that contain tunnels.
- Fix a long-standing bug where TCP reassembly would not function
correctly for some analyzers if dpd_reassemble_first_packets was
set to false.
- Fix a performance bug in the Zeek dictionary code in certain
cases, such as copying a large number of entries from one
dictionary into another.
- Fix a performance issue when inserting large numbers of elements
into a Broker store when Broker::scheduler_policy is set to
stealing.
- Fix a Broker performance issue when distributing large amounts
of data from the input framework to proxies/workers at startup.
- Fix an issue with messaging between proxies and workers that
resulted in error messages being reported.
- Updated the list of DNS type strings to reflect the correct.
Reported by: Tim Wojtulewicz
---
security/vuxml/vuln-2022.xml | 41 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml
index e13d7d8ed980..317a49da5694 100644
--- a/security/vuxml/vuln-2022.xml
+++ b/security/vuxml/vuln-2022.xml
@@ -1,3 +1,44 @@
+ <vuln vid="60d4d31a-a573-41bd-8c1e-5af7513c1ee9">
+ <topic>zeek -- potential DoS vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>zeek</name>
+ <range><lt>5.0.3</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Tim Wojtulewicz of Corelight reports:</p>
+ <blockquote cite="https://github.com/zeek/zeek/releases/tag/v5.0.3">
+ <p> Fix an issue where a specially-crafted FTP packet can
+ cause Zeek to spend large amounts of time attempting to
+ search for valid commands in the data stream. </p>
+ <p> Fix a possible overflow in the Zeek dictionary code
+ that may lead to a memory leak. </p>
+ <p> Fix an issue where a specially-crafted packet can
+ cause Zeek to spend large amounts of time reporting
+ analyzer violations. </p>
+ <p> Fix a possible assert and crash in the HTTP analyzer
+ when receiving a specially crafted packet. </p>
+ <p> Fix an issue where a specially-crafted HTTP or SMTP
+ packet can cause Zeek to spend a large amount of time
+ attempting to search for filenames within the packet data.
+ </p>
+ <p> Fix two separate possible crashes when converting
+ processed IP headers for logging via the raw_packet event
+ handlers. </p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://github.com/zeek/zeek/releases/tag/v5.0.3</url>
+ </references>
+ <dates>
+ <discovery>2022-11-09</discovery>
+ <entry>2022-11-09</entry>
+ </dates>
+ </vuln>
+
<vuln vid="9c399521-5f80-11ed-8ac4-b42e991fc52e">
<topic>darkhttpd -- DOS vulnerability</topic>
<affects>