Bug #5757: http: response content encoding value "none" considered invalid - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5757

closed

http: response content encoding value "none" considered invalid

Added by Victor Julien almost 2 years ago. Updated over 1 year ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

7.0.0

Affected Versions:

Effort:

Difficulty:

Label:

Description

Triggers: alert http any any -> any any (msg:"SURICATA HTTP Request abnormal Content-Encoding header"; flow:established,to_server; app-layer-event:http.abnormal_ce_header; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221033; rev:1;)

See attached pcap.

Files

2221033-1670853035-10.84.1.5-39478-198.100.145.75-80.pcap (68.6 KB) 2221033-1670853035-10.84.1.5-39478-198.100.145.75-80.pcap

Victor Julien, 12/14/2022 09:41 AM

Related issues 1 (0 open — 1 closed)