Open Information Security Foundation

03/03/2025

09:59 PM Suricata Bug #7575 (New): TLS invalid certificate generated for CN=*.his.msappproxy.net

We are seeing this alert triggered for this specific cert.... Orion Poplawski

09:26 PM Suricata Bug #7574 (New): SURICATA DNS malformed request data from macOS to Active Directory DNS server

We are seeing this alert triggered by SOA record requests from a macOS client to our AD DNS server. pcap attached
... Orion Poplawski

03/30/2023

04:05 PM Suricata Bug #5363: Memory leak in rust SMB file tracker

I'd be curious to hear the results of Maayan's tests as well, but on our network we are still seeing significant suri... Orion Poplawski

12/26/2022

09:06 PM Suricata Bug #5183: TLS Handshake Fragments not Reassembled

Is there any chance that this fix will get back ported to 6.0? Orion Poplawski

09/27/2022

08:31 PM Suricata Bug #5320: Key collisions in HTTP JSON eve-logs

I'll also note that the content_range field (and maybe others) are not documented here: https://suricata.readthedocs.... Orion Poplawski

08:25 PM Suricata Bug #5320: Key collisions in HTTP JSON eve-logs

This is causing problems ingesting the Suricata EVE data into ElasticSearch/OpenSearch due to the differing format (o... Orion Poplawski

08/09/2022

02:59 PM Suricata Bug #5492 (New): Applayer Detect protocol only one direction - Kerberos

Some kerberos traffic between a Synology NAS and a Windows Active directory controller generates the following alert:... Orion Poplawski

02:55 PM Suricata Bug #5491 (Closed): SMTP response 530 appears to generate an SMTP invalid response alert

We have a public facing mail server and we see a lot of SMTP invalid reply alerts when it issues a response like:
... Orion Poplawski

08/08/2022

09:02 PM Suricata Bug #5490 (New): Applayer Detect protocol only one direction - NFS

Some NFS traffic generates the following alert:
[**] [1:324000010:1] SURICATA Applayer Detect protocol only one d... Orion Poplawski

10/06/2021

04:45 PM Suricata Bug #4740: libnet error with reject action on pfSense

libnet version is 1.1.6_5,1
Orion Poplawski