CVE-2024-37151
Fixed in a distro release EPSS <1%CVSS 5.3
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.
Products: OISF suricata
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | suricata | 1:6.0.1-3+deb11u1 |
| Debian 13 | suricata | 1:7.0.6-1 |
| Debian 14 | suricata | 1:7.0.6-1 |
| Ubuntu 16.04 LTS | suricata | no fix |
| Ubuntu 18.04 LTS | suricata | no fix |
| Ubuntu 22.04 LTS | suricata | no fix |
| Ubuntu 24.04 LTS | suricata | no fix |
| openSUSE Tumbleweed | suricata | 8.0.0-1.1 |