Log in Start free

Vulnerability · Published Jan 6, 2025 · Assigned by GitHub_M

CVE-2024-55629Suricata generic detection bypass using TCP urgent support

High 7.5

In plain English

A high-severity security flaw in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 54.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urgent data (out of band data) can lead to Suricata analyzing data differently than the applications at the TCP endpoints, leading to possible evasions. Suricata 7.0.8 includes options to allow users to configure how to handle TCP urgent data. In IPS mode, you can use a rule such as drop tcp any any -> any any (sid:1; tcp.flags:U*;) to drop all the packets with urgent flag set.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21suricata7.0.8-r0ALPINE-CVE-2024-55629
Alpine:v3.22suricata7.0.8-r0ALPINE-CVE-2024-55629
Alpine:v3.23suricata7.0.8-r0ALPINE-CVE-2024-55629
Alpine:v3.24suricata7.0.8-r0ALPINE-CVE-2024-55629
Debian:13suricata1:7.0.8-1DEBIAN-CVE-2024-55629
Debian:14suricata1:7.0.8-1DEBIAN-CVE-2024-55629
Ubuntu:22.04:LTSsuricatano fix listedUBUNTU-CVE-2024-55629
Ubuntu:24.04:LTSsuricatano fix listedUBUNTU-CVE-2024-55629

Affected products (as reported)

VendorProductVersions
OISF suricata < 7.0.8

Weakness: CWE-437 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References