Actions
Bug #4317
openinvalid dsize distance rule being loaded by suricata (6.0.x backport)
Affected Versions:
Effort:
Difficulty:
Label:
Description
The following rule, originally submitted under issue #317 is being loaded successfully but doesn't seem like it should be.
alert udp any any -> any any (msg:"TEST SUCCESFULL - dsize/distance INVALID combination "; dsize:10; content:"boom"; content:"loom"; distance:10; sid:6666663; rev:1;)
Updated by Jeff Lucovsky over 2 years ago
- Copied from Bug #2982: invalid dsize distance rule being loaded by suricata added
Updated by Victor Julien over 2 years ago
- Target version changed from 6.0.2 to 6.0.3
Updated by Victor Julien almost 2 years ago
- Target version changed from 6.0.3 to 6.0.4
Updated by Victor Julien over 1 year ago
- Target version changed from 6.0.4 to 6.0.5
Updated by Victor Julien about 1 year ago
- Target version changed from 6.0.5 to 6.0.6
Updated by Victor Julien about 1 year ago
- Target version changed from 6.0.6 to 6.0.7
Updated by Victor Julien 8 months ago
- Target version changed from 6.0.7 to 6.0.8
Updated by Victor Julien 8 months ago
- Target version changed from 6.0.8 to 6.0.9
Updated by Victor Julien 7 months ago
- Subject changed from invalid dsize distance rule being loaded by suricata to invalid dsize distance rule being loaded by suricata (6.0.x backport)
Updated by Victor Julien 6 months ago
- Target version changed from 6.0.9 to 6.0.10
Updated by Victor Julien 6 months ago
- Assignee changed from Shivani Bhardwaj to Jeff Lucovsky
Updated by Jeff Lucovsky 6 months ago
- Status changed from Assigned to In Review
Updated by Victor Julien 4 months ago
- Target version changed from 6.0.10 to 6.0.11
Updated by Victor Julien 2 months ago
- Target version changed from 6.0.11 to 6.0.12
Needs to be forgiving wrt loading broken rules to avoid upgrade issues, see https://github.com/OISF/suricata/pull/8245
Updated by Victor Julien 29 days ago
- Status changed from In Review to Assigned
- Target version changed from 6.0.12 to 6.0.13
Moving back to "assigned" as it seems we've stalled on this.
Actions