Ajaxtpm

**Name of the Vulnerable Software and Affected Versions** OISF LibHTP versions prior to 0.5.31 Suricata version 4.1.4 **Description** An HTTP protocol parsing error occurs in the affected software, causing the http header signature to not alert on a response with a single r ending. **Recommendations** For OISF LibHTP versions prior to 0.5.31, update to version 0.5.31 or later to resolve the issue. For Suricata version 4.1.4, consider updating to a newer version that incorporates the fix for OISF LibHTP.

**Name of the Vulnerable Software and Affected Versions** Suricata versions prior to 4.0.5 **Description** The issue allows for detection bypass due to the way Suricata handles TCP RST packets from servers. Specifically, when a TCP RST is received from a server, Suricata stops inspecting the TCP stream. However, Windows TCP clients continue processing TCP data that arrives shortly after the RST as if the RST had not been received. This discrepancy enables potential bypass of detection mechanisms. **Recommendations** For Suricata versions prior to 4.0.5, update to version 4.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Suricata versions prior to 4.x **Description** The issue is related to the DetectEngineContentInspection component in Suricata, which can be triggered by crafted network traffic with a certain signature. This causes the search engine to perform redundant checks on the content, leading to potential denial of service. The search engine fails to stop when it should after no match is found, instead stopping only upon reaching the inspection-recursion-limit, which is 3000 by default. An attacker could exploit this to cause a denial of service using specially crafted network traffic, resulting in excessive checks. **Recommendations** For Suricata versions prior to 4.x, consider updating to version 4.x or later to resolve the issue. As a temporary workaround, consider adjusting the inspection-recursion-limit to a lower value to minimize the risk of exploitation. Restrict access to the DetectEngineContentInspection component to minimize the risk of denial of service attacks.