Actions
Bug #2004
closedInvalid file hash computation when force-hash is used
Affected Versions:
Effort:
Difficulty:
Label:
Description
The hash computed is not correct in Suricata 3.2 when the 'force-hash' keyword is used. This results in false negative (and possibly false positive) when file[hash] keyword is used in a signature.
Updated by Eric Leblond almost 8 years ago
In fact, the hash is not correct for sha256 if we are using force-hash: [md5, sha256] or force-hash: [md5, sha256]. In both cases, md5 hash is correct.
If using force-hash: [sha256] then the sha256 is correct.
Updated by Eric Leblond almost 8 years ago
- Status changed from Assigned to Closed
Fixed via first patch of https://github.com/inliniac/suricata/pull/2499
Actions