Vulnerability · Published Apr 3, 2024 · Assigned by GitHub_M
CVE-2024-28870Suricata uses excessive resource use in malformed ssh traffic parsing
High 7.5
In plain English
A high-severity resource allocation without limits in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. When parsing an overly long SSH banner, Suricata can use excessive CPU resources, as well as cause excessive logging volume in alert records. This issue has been patched in versions 6.0.17 and 7.0.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | suricata | 1:7.0.4-1 | DEBIAN-CVE-2024-28870 |
| Debian:14 | suricata | 1:7.0.4-1 | DEBIAN-CVE-2024-28870 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-28870 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-28870 |
| Ubuntu:25.10 | suricata | no fix listed | UBUNTU-CVE-2024-28870 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-28870 |
| Ubuntu:26.10 | suricata | no fix listed | UBUNTU-CVE-2024-28870 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/OISF/suricata/security/advisories/GHSA-mhhx-xw7r-r5c8 x_refsource_CONFIRM