Vulnerability · Published Jun 19, 2023 · Assigned by mitre
CVE-2023-35852
High 7.5
In plain English
A high-severity security flaw in the suricata package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, may trigger absolute or relative directory traversal, and lead to write access to a local filesystem. This is addressed in 6.0.13 by requiring allow-absolute-filenames and allow-write (in the datasets rules configuration section) if an installation requires traversal/writing in this situation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | suricata | 1:6.0.13-1 | DEBIAN-CVE-2023-35852 |
| Debian:14 | suricata | 1:6.0.13-1 | DEBIAN-CVE-2023-35852 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2023-35852 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2023-35852 |
| Ubuntu:25.10 | suricata | no fix listed | UBUNTU-CVE-2023-35852 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2023-35852 |
| Ubuntu:26.10 | suricata | no fix listed | UBUNTU-CVE-2023-35852 |
Affected products (as reported)
References
- https://github.com/OISF/suricata/compare/suricata-6.0.12...suricata-6.0.13
- https://github.com/OISF/suricata/commit/aee1523b4591430ebed1ded0bb95508e6717a335
- https://github.com/OISF/suricata/commit/735f5aa9ca3b28cfacc7a443f93a44387fbacf17
- https://www.stamus-networks.com/stamus-labs
- https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html