From 4c28cc1b4ac64f48efdca6ce3e09748227a04a7e Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Tue, 7 Jul 2026 17:10:35 +0530 Subject: [PATCH] release: 8.0.6; update changelog --- ChangeLog | 46 +++++++++++++++++++++++++++++++++++++++++++++ configure.ac | 2 +- requirements.txt | 2 +- rust/Cargo.lock.in | 12 ++++++------ rust/sys/src/sys.rs | 2 +- 5 files changed, 55 insertions(+), 9 deletions(-) diff --git a/ChangeLog b/ChangeLog index f3a86b963b..8f0dcdc840 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,49 @@ +8.0.6 -- 2026-07-07 + +Security #8653: mqtt: unbounded number of messages per tx (8.0.x backport)(HIGH - CVE 2026-57227) +Security #8650: smtp: evasion due to incomplete state reset (8.0.x backport)(MODERATE - CVE 2026-57229) +Security #8643: detect/file_data: heap buffer overflow in SWF decompression depth handling (8.0.x backport)(LOW - CVE 2026-57226) +Security #8627: windows: unquoted LocalSystem service ImagePath (8.0.x backport)(LOW - CVE 2026-57223) +Security #8625: datasets: NULL dereference on unexpected ndjson files (8.0.x backport)(LOW - CVE 2026-57225) +Security #8622: dhcp: unbounded tx growth with unidirectional traffic (8.0.x backport)(MODERATE - CVE 2026-57224) +Security #8568: ippair: IPv4/IPv6 hash collision can reuse wrong IPPair state (8.0.x backport)(MODERATE - CVE 2026-57222) +Security #8636: smb: unbounded memory for transactions on unidirectional flows (8.0.x backport) +Security #8591: detect: overflow on frame keyword use with pcre and transform (8.0.x backport) +Security #8637: applayer: transaction leak and O(n^2) CPU on passed flows (8.0.x backport) +Security #8726: doh2: quadratic complexity due to buffer not being reset (8.0.x backport) +Security #8657: sip: u16 truncation of body_len evades body inspection (8.0.x backport) +Security #8607: ftp: quadratic complexity in tx creation (8.0.x backport) +Security #8695: http1: multiple brotli bombs on a flow are slow (8.0.x backport) +Security #8660: ftp: RETR without PORT/PASV triggers permanent app-layer detection bypass (8.0.x backport) +Security #8570: flow: IPv4/IPv6 hash collision can reuse wrong flow state (8.0.x backport) +Bug #8723: rdp: transaction id handling can cause skips in tx cleanup (8.0.x backport) +Bug #8722: firewall: non-sequential tx causes issues (8.0.x backport) +Bug #8711: flow-manager: no flow timeout with flow.hash-size < 10 (8.0.x backport) +Bug #8696: ftp: support data channel for list, nlst, mlsd, appe, stou (8.0.x backport) +Bug #8670: ftp: can't proceed past banner in firewall mode (8.0.x backport) +Bug #8669: ftp: ftpdata_command never matches in firewall mode for active ftp (8.0.x backport) +Bug #8668: af-packet: IPS copy-mode startup race causes permanent ENOTSOCK on peer socket (8.0.x backport) +Bug #8655: pcap-file: failure reading pcaps from stdin or named pipe (8.0.x backport) +Bug #8652: conf: null deref when using YAML null values (8.0.x backport) +Bug #8646: firewall: accept-prior states logic doesn't work for built-in hooks (8.0.x backport) +Bug #8620: applayer: pass rules on UDP flows cause unbounded memory growth (8.0.x backport) +Bug #8616: decoder/ieee8021ah: missing layer check (8.0.x backport) +Bug #8614: defrag: memuse accounting error in alloc failure case (8.0.x backport) +Bug #8573: firewall: accept:flow at app-layer hook bypasses app:td (IDS/IPS) evaluation (8.0.x backport) +Bug #8498: firewall: limit packet scope to UDP app-layer (8.0.x backport) +Bug #8496: firewall: ruleset can skip hook if only later rules are present (8.0.x backport) +Feature #8611: firewall: Auto-Accept Prior States syntax for firewall mode intent rules (8.0.x backport) +Feature #8610: firewall: separate stats for ips and firewall (8.0.x backport) +Feature #8609: firewall: support generating alerts on default policy (8.0.x backport) +Feature #8602: firewall: drop action should not imply alert (8.0.x backport) +Feature #8574: firewall: configurable default policies (8.0.x backport) +Feature #8572: firewall: allow specifying multiple actions (8.0.x backport) +Feature #8564: firewall: support FTP hook states for firewall rule evaluation (8.0.x backport) +Feature #8519: firewall: analyzer: complete rule table coverage (8.0.x backport) +Task #8638: flowbits: deprecate "toggle" command +Task #8535: psl: crate should be updated on every release (8.0.x backport) +Documentation #8567: doc: improve manpage of suricatasc (8.0.x backport) + 8.0.5 -- 2026-05-19 Security #8561: defrag: fragmented encapsulated traffic with fragments can lead to deadlock (8.0.x backport)(HIGH - CVE 2026-46352) diff --git a/configure.ac b/configure.ac index 4443de16cd..7b532c4cac 100644 --- a/configure.ac +++ b/configure.ac @@ -1,4 +1,4 @@ - AC_INIT([suricata],[8.0.6-dev]) + AC_INIT([suricata],[8.0.6]) m4_ifndef([AM_SILENT_RULES], [m4_define([AM_SILENT_RULES],[])])AM_SILENT_RULES([yes]) AC_CONFIG_HEADERS([src/autoconf.h]) AC_CONFIG_SRCDIR([src/suricata.c]) diff --git a/requirements.txt b/requirements.txt index 2f9e691de8..a3b3455f9f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,4 +3,4 @@ # Format: # # name {repo} {branch|tag} -suricata-update https://github.com/OISF/suricata-update 1.3.7 +suricata-update https://github.com/OISF/suricata-update 1.3.8 diff --git a/rust/Cargo.lock.in b/rust/Cargo.lock.in index 8b5c9f01ae..26971e08c1 100644 --- a/rust/Cargo.lock.in +++ b/rust/Cargo.lock.in @@ -1512,7 +1512,7 @@ checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601" [[package]] name = "suricata" -version = "8.0.6-dev" +version = "8.0.6" dependencies = [ "aes", "aes-gcm", @@ -1565,7 +1565,7 @@ dependencies = [ [[package]] name = "suricata-derive" -version = "8.0.6-dev" +version = "8.0.6" dependencies = [ "proc-macro-crate", "proc-macro2", @@ -1575,7 +1575,7 @@ dependencies = [ [[package]] name = "suricata-htp" -version = "8.0.6-dev" +version = "8.0.6" dependencies = [ "base64", "brotli", @@ -1601,11 +1601,11 @@ dependencies = [ [[package]] name = "suricata-sys" -version = "8.0.6-dev" +version = "8.0.6" [[package]] name = "suricatactl" -version = "8.0.6-dev" +version = "8.0.6" dependencies = [ "clap", "once_cell", @@ -1616,7 +1616,7 @@ dependencies = [ [[package]] name = "suricatasc" -version = "8.0.6-dev" +version = "8.0.6" dependencies = [ "clap", "home", diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs index 49d5acfaf0..fc998bc08f 100644 --- a/rust/sys/src/sys.rs +++ b/rust/sys/src/sys.rs @@ -1,6 +1,6 @@ // This file is automatically generated. Do not edit. -pub const SC_PACKAGE_VERSION: &[u8; 10] = b"8.0.6-dev\0"; +pub const SC_PACKAGE_VERSION: &[u8; 6] = b"8.0.6\0"; pub type __intmax_t = ::std::os::raw::c_long; pub type intmax_t = __intmax_t; #[repr(u32)]