OSSEC changelog (4.2.0) support@atomicorp.com
Release Maintainers
Dan Parriott
Scott R. Shinn (https://www.atomicorp.com)
Contributors on this release
Release Notes
This release focuses on analysisd scalability and broader stability. Key enhancements include an always-on multi-threaded analysisd pipeline for Linux servers, pthread migration for manager daemons, rootcheck file-hash enrichment in alerts, and a self-contained Windows agent installer that ships required MinGW/OpenSSL runtime DLLs. It also includes numerous fixes across authd, maild, syscheck, logcollector, and rules.
Security Fixes
- @atomicturtle - PR 2216 - Fix ossec-authd failure under modern Linux crypto policies (RHEL 8+)
- @atomicturtle - PR 2219 - Fix ossec-maild heap corruption when building alert email bodies
General
- @atomicturtle - PR 2214 - Migrate manager daemons to pthreads and add shared thread pool support
- @atomicturtle - PR 2220 - Keep ossec-maild running when SMTP is temporarily unavailable
- @atomicturtle - PR 2228 - Validate agent keys with OS_IsValidIP for IPv6 authd -i keys
- @atomicturtle - PR 2232 - Indicate when report_changes diffs are truncated (#455)
- @atomicturtle - PR 2236 - Update stale IIS and Windows doc URLs in setup helpers (#1975)
- @Hu6li - PR 2244 - Append MD5/SHA1/SHA256 hashes of detected rootcheck files to alerts
- @atomicturtle - PR 2246 - Multi-threaded analysisd event pipeline for Linux servers
- @atomicturtle - PR 2247 - Bundle MinGW/OpenSSL runtime DLLs in the Windows agent installer (#2241)
Bug Fixes
- @atomicturtle - PR 2217 - Fix memory leak in analysisd OS_IsValidIP path (#2108)
- @atomicturtle - PR 2218 - Fix agent getaddrinfo failures on RHEL 8+ by retrying with IPv4
- @atomicturtle - PR 2221 - Fix Windows agent ignoring configured notify_time for keep-alives
- @atomicturtle - PR 2223 - Fix logcollector memory leak when duplicate localfiles are configured
- @atomicturtle - PR 2225 - Fix wrong CloseHandle on Windows realtime duplicate hash path
- @atomicturtle - PR 2226 - Fix frequency rule alert context showing unrelated log lines (#1079)
- @atomicturtle - PR 2227 - Fix incomplete syscheck baseline database population (#1248)
- @atomicturtle - PR 2229 - Fix syscheck diff false errors and snapshot handling (#1296)
- @atomicturtle - PR 2230 - Restore rule.group in JSON alert output (#1838)
- @atomicturtle - PR 2231 - Fix authd graceful SIGINT/SIGTERM shutdown (#919)
- @atomicturtle - PR 2233 - Honor localfile command frequency after logcollector restart (#1415)
- @atomicturtle - PR 2234 - Restore linear scan fallback for syscheck db lookups (#1248)
- @atomicturtle - PR 2235 - Poll journald continuously instead of on command frequency (#2110)
- @atomicturtle - PR 2237 - Fix false CIS apt sources alert on Ubuntu 24.04
- @atomicturtle - PR 2238 - Fix false dpkg install alert when removing packages
- @atomicturtle - PR 2239 - Fix msauth Enterprise Admins false positives and negatives
- @atomicturtle - PR 2240 - Fix Postfix rule 3331 false positive on postscreen client ports
- @atomicturtle - PR 2243 - Fix AIX agent entropy failure after chroot by keeping OS RNG usable