Changcheng Wu

Suricata is a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. The file `src/datasets-context-json.c` incorrectly assumes that a configured JSON or NDJSON dataset `value key` always resolves to a string. If a dataset or rule feed contains a non-string value for this key, it can trigger a NULL pointer dereference—a condition where the software attempts to read data from a memory address that is null—during startup, configuration test mode, or rule reload. This results in the application crashing before traffic processing begins.

The FTP parser in `src/app-layer-ftp.c` incorrectly handles RETR or STOR commands when they are sent before PORT or PASV negotiation. Instead of treating this as a recoverable protocol event, the system marks it as a fatal application-layer error. This fatal state disables FTP application-layer parsing for the rest of the TCP flow, allowing subsequent commands to bypass parser-dependent rules and logging. In IPS mode, the system drops the flow entirely.

تم اكتشاف مشكلة في Suricata تتطلب تحديثًا أمنيًا.