Debian Package Tracker

general

source: suricata (main)
version: 1:4.1.4-2
maintainer: Pierre Chifflier [DMD]
uploaders: Sascha Steinbiss [DMD] – Arturo Borrero Gonzalez [DMD]
arch: all
std-ver: 4.1.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 2.0.7-2+deb8u1
old-sec: 2.0.7-2+deb8u4
stable: 3.2.1-1+deb9u1
stable-bpo: 1:4.1.2-2~bpo9+1
testing: 1:4.1.2-2
unstable: 1:4.1.4-2

versioned links

2.0.7-2+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.0.7-2+deb8u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.1-1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.1.2-2~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.1.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.1.4-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

suricata (3 bugs: 0, 3, 0, 0)
suricata-oinkmaster

action needed

lintian reports 1 error and 3 warnings high

Lintian reports 1 error and 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2019-03-16 Last update: 2019-03-16 05:40

4 bugs tagged patch in the BTS normal

The BTS contains patches fixing 4 bugs, consider including or untagging them.

Created: 2019-04-01 Last update: 2019-06-25 17:06

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2019-05-05 Last update: 2019-06-25 16:57

Depends on packages which need a new maintainer normal

The packages that suricata depends on which need a new maintainer are:

lsb (#924519)
- Depends: lsb-base

Created: 2019-03-13 Last update: 2019-06-25 12:49

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 4f0fcff6ba335e88934cc9052c007e19ed54c575
Author: Sascha Steinbiss <satta@debian.org>
Date:   Thu May 2 16:33:56 2019 +0200

    fix #924096

Created: 2019-05-02 Last update: 2019-06-25 10:07

9 ignored security issues in stretch low

There are 9 open security issues in stretch.

9 issues skipped by the security teams:

CVE-2018-10244: Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated data because DecodeENIPPDU in app-layer-enip-commmon.c has an integer overflow during a length check.
CVE-2018-10243: htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header.
CVE-2018-10242: Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data because SSHParseBanner in app-layer-ssh.c lacks a length check.
CVE-2017-15377: In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default).
CVE-2019-10050: A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.
CVE-2018-14568: Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).
CVE-2018-6794: Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.
CVE-2018-18956: The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segfault and daemon crash) via crafted input to the SMTP parser, as exploited in the wild in November 2018.
CVE-2019-10053: An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.

Please fix them.

Created: 2017-10-24 Last update: 2019-06-22 01:07

3 ignored security issues in jessie low

There are 3 open security issues in jessie.

3 issues skipped by the security teams:

CVE-2019-10050: A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.
CVE-2018-14568: Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).
CVE-2019-10053: An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.

Please fix them.

Created: 2017-03-03 Last update: 2019-06-22 01:07

2 ignored security issues in buster low

There are 2 open security issues in buster.

2 issues skipped by the security teams:

CVE-2019-10050: A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.
CVE-2019-10053: An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.

Please fix them.

Created: 2019-05-13 Last update: 2019-06-22 01:07

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2019-01-10 Last update: 2019-01-10 01:09

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.3.0 instead of 4.1.3).

Created: 2018-04-16 Last update: 2019-05-03 16:57

testing migrations

excuses:
- 53 days old (2 needed)
- Piuparts tested OK - https://piuparts.debian.org/sid/source/s/suricata.html
- Required age reduced by 3 days because of autopkgtest
- Not touching package due to block request by freeze (please contact debian-release if update is needed)
- Not considered

news

[rss feed]

[2019-05-03] Accepted suricata 1:4.1.4-2 (source) into unstable (Sascha Steinbiss)
[2019-05-01] Accepted suricata 1:4.1.4-1 (source amd64 all) into unstable (Pierre Chifflier)
[2019-04-08] Accepted suricata 2.0.7-2+deb8u4 (source amd64) into oldstable (Hugo Lefeuvre)
[2019-03-08] Accepted suricata 1:4.1.3-1 (source amd64 all) into unstable (Pierre Chifflier)
[2019-01-17] Accepted suricata 1:4.1.2-3~exp1 (source amd64 all) into experimental (Sascha Steinbiss)
[2019-01-15] Accepted suricata 1:4.1.2-2~bpo9+1 (source amd64 all) into stretch-backports (Sascha Steinbiss)
[2019-01-12] suricata 1:4.1.2-2 MIGRATED to testing (Debian testing watch)
[2019-01-09] Accepted suricata 1:4.1.2-2 (source amd64 all) into unstable (Sascha Steinbiss)
[2018-12-26] Accepted suricata 1:4.1.2-1 (source amd64 all) into experimental (Sascha Steinbiss)
[2018-12-04] Accepted suricata 2.0.7-2+deb8u3 (source amd64) into oldstable (Markus Koschany)
[2018-11-26] Accepted suricata 1:4.1.0-2 (source amd64 all) into experimental (Pierre Chifflier)
[2018-11-17] suricata 1:4.0.6-1 MIGRATED to testing (Debian testing watch)
[2018-11-15] Accepted suricata 1:4.1.0-1 (source amd64 all) into experimental (Pierre Chifflier)
[2018-11-12] Accepted suricata 1:4.0.6-1 (source amd64 all) into unstable (Pierre Chifflier)
[2018-09-20] Accepted suricata 2.0.7-2+deb8u2 (source amd64) into oldstable (Thorsten Alteholz)
[2018-08-03] suricata 1:4.0.5-1 MIGRATED to testing (Debian testing watch)
[2018-07-18] Accepted suricata 1:4.0.5-1 (source amd64 all) into unstable (Pierre Chifflier)
[2018-02-22] Accepted suricata 1:4.0.4-1~bpo9+1 (source) into stretch-backports (Arturo Borrero Gonzalez)
[2018-02-19] suricata 1:4.0.4-1 MIGRATED to testing (Debian testing watch)
[2018-02-14] Accepted suricata 1:4.0.4-1 (source) into unstable (Arturo Borrero Gonzalez)
[2017-12-26] Accepted suricata 1:4.0.3-1~bpo9+1 (source amd64) into stretch-backports (Arturo Borrero Gonzalez)
[2017-12-22] suricata 1:4.0.3-1 MIGRATED to testing (Debian testing watch)
[2017-12-13] Accepted suricata 1:4.0.3-1 (source) into unstable (Arturo Borrero Gonzalez)
[2017-11-29] Accepted suricata 1:4.0.1-2~bpo9+1 (source) into stretch-backports (Arturo Borrero Gonzalez)
[2017-11-28] suricata 1:4.0.1-2 MIGRATED to testing (Debian testing watch)
[2017-11-23] Accepted suricata 1:4.0.1-2 (source) into unstable (Arturo Borrero Gonzalez)
[2017-10-27] Accepted suricata 1:4.0.1-1~bpo9+1 (source amd64) into stretch-backports (Arturo Borrero Gonzalez)
[2017-10-26] suricata 1:4.0.1-1 MIGRATED to testing (Debian testing watch)
[2017-10-21] Accepted suricata 1:4.0.1-1 (source amd64) into unstable (Arturo Borrero Gonzalez)
[2017-09-28] Accepted suricata 1:4.0.0-5~bpo9+1 (source amd64) into stretch-backports (Arturo Borrero Gonzalez)

bugs [bug history graph]

all: 7
RC: 0
I&N: 6
M&W: 1
F&P: 0
patch: 4

links

homepage
lintian (1, 3)
buildd: logs, checks, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.2-2ubuntu6
patches for 3.2-2ubuntu6