Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount of HTTP/2 traffic can lead to Suricata using a large amount of memory. The issue has been addressed in Suricata 7.0.5 and 6.0.19. Workarounds include disabling the HTTP/2 parser and reducing `app-layer.protocols.http2.max-table-size` value (default is 65536).

The version of OISF Suricata installed on the remote host is prior to 6.0.19 or 7.x prior to 7.0.5. It is, therefore, affected by multiple vulnerabilities: 

  - In affected versions, specially crafted traffic or datasets can cause a limited buffer overflow.     (CVE-2024-32664)     
  - In affected versions, a small amount of HTTP/2 traffic can lead to Suricata using a large amount of memory.
    (CVE-2024-32663)     
  - In affected versions, various problems in handling of fragmentation anomalies can lead to mis-detection of rules     and policy. (CVE-2024-32867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the suricata package has been released.

ID	Name	Product	Family	Severity
206344	Suricata 6.x < 6.0.19 / 7.x < 7.0.5 Multiple Vulnerabilities	Nessus	Misc.	high
204571	Photon OS 5.0: Suricata PHSA-2024-5.0-0267	Nessus	PhotonOS Local Security Checks	high
204367	Photon OS 4.0: Suricata PHSA-2024-4.0-0606	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2024-32663

high

Tenable Plugins

high

high

high