CVE-2024-23835: Suricata's pgsql: memory exhaustion use on record parsing
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excessive memory use during pgsql parsing could lead to OOM-related crashes. This vulnerability is patched in 7.0.3. As workaround, users can disable the pgsql app layer parser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.3 - Configuration
Disable the pgsql app layer parser as a workaround to prevent excessive memory use during pgsql parsing (noted for versions prior to 7.0.3).
Suricata pgsql app-layer parser pgsql app layer parser = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23835?
CVE-2024-23835 has a high severity due to excessive memory use leading to potential OOM-related crashes.
How do I fix CVE-2024-23835?
To fix CVE-2024-23835, upgrade Suricata to version 7.0.3 or later.
What versions of Suricata are affected by CVE-2024-23835?
Suricata versions prior to 7.0.3 are affected by CVE-2024-23835.
Does CVE-2024-23835 affect Fedora systems?
Yes, CVE-2024-23835 affects Fedora versions 38 and 39 if they are running vulnerable Suricata versions.
Is there a workaround for CVE-2024-23835?
A specific workaround for CVE-2024-23835 is not detailed, but upgrading to the patched version is recommended.