CVE-2024-23839 | Vulnetix

CVE-2024-23839 PUBLISHED CVSS 7.099999904632568 HIGH

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially crafted traffic can cause a heap use after free if the ruleset uses the http.request_header or http.response_header keyword. The vulnerability has been patched in 7.0.3. To work around the vulnerability, avoid the http.request_header and http.response_header keywords.

EPSS 0.78% · 53.4th percentile

Risk Scores

CVSS 3.1

7.099999904632568

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS Score

0.78%

53.4th percentile

Affected Products

Vendor	Product	Versions
oisf	suricata	7.0.0, 7.0.0, 7.0.0
fedoraproject	fedora	39, 38, 38
oisf	suricata	7.0.0, 7.0.0
OISF	suricata	>= 7.0.0, < 7.0.3, >= 7.0.0, < 7.0.3

Timeline

Jan 21, 1970 Security Advisory
Feb 26, 2024 CVE Published
Feb 27, 2024 EPSS Score
Mar 14, 2024 PoC Published
Mar 25, 2024 EPSS Score
Apr 20, 2024 EPSS Score
Jun 13, 2024 EPSS Score
Jul 10, 2024 EPSS Score
Aug 5, 2024 EPSS Score
Sep 1, 2024 EPSS Score
Oct 4, 2024 Coalition ESS Score
Oct 25, 2024 EPSS Score

References

Open in Interactive Console →