CVE-2024-32867: medium-severity vulnerability in OISF suricata
Suricata's defrag contains various issues leading to policy bypass
Published · Updated
No sign of exploitation. No public exploitation artifact known so far.
Suricata, a network security monitoring tool, has issues detecting fragmented network packets correctly, which could allow malicious traffic to bypass security rules. An attacker could craft fragmented packets to slip past the security monitoring system.
The vulnerability exists in Suricata's defragmentation handling logic prior to versions 7.0.5 and 6.0.19, where improper processing of fragmentation anomalies causes rule mismatches and policy bypass. An attacker can craft malformed IP fragments to evade intrusion detection/prevention rules. Impact includes circumvention of configured security policies for fragmented traffic detection.
In the same product, most dangerous first.