zeek/zeek v3.0.11

on GitHub

This release fixes the following security issues:

• Fix multipart MIME leak of sub-part found after closing-boundary

  After detecting a closing-boundary for a given multipart MIME entity, it
  enters into an "end of data" state, however any subsequent boundary
  delimiter could still cause the allocation of a sub-entity object that
  is never released due to cleanup logic being bypassed upon finding the
  "end of data" state already reached.

  This change prevents allocation/processing of sub-entities after the
  "end of data" state is reached (e.g. from detecting a multipart
  closing-boundary). This new behavior still aligns with RFC 2046
  expectations:

  "There appears to be room for additional information prior to the first
  boundary delimiter line and following the final boundary delimiter line.
  These areas should generally be left blank, and implementations must
  ignore anything that appears before the first boundary delimiter line or
  after the last one."

  This leak has potential for remote exploitation and cause for Denial of
  Service via resource exhaustion.

  Credit to OSS-Fuzz for discovery
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26027
  (Link to details becomes public 30 days after patch release)

This release fixes the following bugs:

• Fix incorrect RSTOS0 conn_state determinations
  #1164
  #1166

Reminder: Zeek 3.0.x is a Long-Term Support release, receiving bug fixes until at least December 2020.