Clouditera

Suricata is a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. The file `src/datasets-context-json.c` incorrectly assumes that a configured JSON or NDJSON dataset `value key` always resolves to a string. If a dataset or rule feed contains a non-string value for this key, it can trigger a NULL pointer dereference—a condition where the software attempts to read data from a memory address that is null—during startup, configuration test mode, or rule reload. This results in the application crashing before traffic processing begins.

The FTP parser in `src/app-layer-ftp.c` incorrectly handles RETR or STOR commands when they are sent before PORT or PASV negotiation. Instead of treating this as a recoverable protocol event, the system marks it as a fatal application-layer error. This fatal state disables FTP application-layer parsing for the rest of the TCP flow, allowing subsequent commands to bypass parser-dependent rules and logging. In IPS mode, the system drops the flow entirely.

An issue was identified in Suricata that requires a security update.

A logic issue exists in the `webrtcbin` component. The ` check sdp crypto()` function uses an inverted boolean condition, leading the system to accept remote Session Description Protocol (SDP) offers or answers that miss the mandatory `a=fingerprint` attribute, while rejecting those that correctly include it. An attacker capable of intercepting and modifying WebRTC signaling messages can bypass the SDP-level Datagram Transport Layer Security (DTLS) certificate fingerprint binding, which reduces protection against man-in-the-middle attacks on media streams.