Attributed metadata history

v8.2.2

Thank you to Peter Cullen (@pbcullen), Stefan Goetz (@stefangoetzcorelight), Jan Grashöfer (@J-Gras), Eldon Koyle (@ekoyle), Simeon Miteff (simeonmiteff), Kara Zaffarano and Kyle Elliott of Trail of Bits in collaboration with OpenAI, AdaLogics in collaboration with Anthropic, and the Canadian Communications Security Establishment for their contributions to this release. This release fixes the following security issues: HIGH: SMB: Chains of AndX messages can crash Zeek Advisory: GHSA-2xc9-g36m-w7jh HIGH: DNP3: Memory exhaustion via file control (g70v1) fields Advisory: GHSA-px95-jfxw-4jw2 HIGH: SIP: Memory exhaustion from long request/response paths Advisory: GHSA-wjf9-326g-m9h3 HIGH: DHCP: Memory exhaustion from retained options after analyzer violation Advisory: GHSA-hxj7-pcq9-c949 HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries Advisory: GHSA-49x5-fmqq-4ccv HIGH: SMB: DCE/RPC memory exhaustion from fragment state Advisory: GHSA-rmc2-mqq6-wcw9 HIGH: Analyzer manager: Equivalent scheduled analyzers could exhaust memory Advisory: GHSA-3gxr-8f49-vrgr HIGH: ZIP: Unbounded decompression Advisory: GHSA-2prm-q48h-m96w HIGH: Redis: Parsed Redis traffic memory exhaustion Advisory: GHSA-c573-w89f-fpxm HIGH: Invalid IPv6 fragments can lead to unbounded state growth Advisory: GHSA-84jg-cwr7-4p6w HIGH: SSH: Quadratic KEX algorithm CPU exhaustion Advisory: GHSA-5v93-pm35-5mq6 HIGH: NVT: Oversized line recovery writes before heap buffer Advisory: GHSA-hww6-p5xp-6rqv HIGH: DHCP: Unbounded state growth via join_data Advisory: GHSA-qf53-234m-7vhq HIGH: FTP: Unbounded state growth via ftp_data_expected Advisory: GHSA-9m23-gwjx-p3j8 HIGH: OCSP: Empty byName responder ID crashes Zeek Advisory: GHSA-j48p-9pm3-pgpx HIGH: ARP: Tunneled ARP traffic crashes Zeek Advisory: GHSA-924m-g9gv-45xc HIGH: LDAP: Unbounded per-connection script state Advisory: GHSA-pxc9-fc9v-r39q HIGH: IRC DCC SEND has unbounded state growth Advisory: GHSA-5h5v-fcxr-f223 HIGH: tunnel_changed event limit bypass on direct/tunneled toggles Advisory: GHSA-72qh-gpq9-cj8w HIGH: Recursive stack exhaustion from deep packet analyzer chains Advisory: GHSA-vh6p-7vxf-m7rh MEDIUM: Telnet: AUTH STATUS options before a NAME is received results in event argument mismatch Advisory: GHSA-qjhc-rfmf-3vgp MEDIUM: UDP: udp_contents events could trigger out-of-bounds reads Advisory: GHSA-q48f-3qm2-j875 MEDIUM: NetBIOS: Memory exhaustion from declared session lengths Advisory: GHSA-gq9q-85wf-mq48 MEDIUM: IRC: Single DCC Send packet can result in scripting error Advisory: GHSA-6566-755c-7mwq MEDIUM: IRC: Invalid DCC Send host/port fields can lead to unexpected parsing results Advisory: GHSA-q6c5-95ff-cwr9 This release fixes the following bugs: IN_ANYWHERE is now allowed as a wildcard in Intel files for the interface field. The Prometheus service discovery endpoint for the telemetry framework was not rendering IPv6 addresses correctly. The unknown_protocols.log previously included the IP next protocol field as a 16 bit value, with the first byte value set to the next protocol followed by a zero byte due to a spurious use of htons(). This has been fixed to be just the next protocol byte. Fixed file descriptors of the WebSocket server and WebSocket client connections (Cluster::listen_websocket()) being inherited by child processes. E.g., when using system() in Zeek scripts or the Input Framework's raw reader functionality.

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.