zeek/zeek v4.0.1

on GitHub

This release fixes the following security issue:

• Fix null-pointer dereference when encountering an invalid enum name in a
  config/input file that tries to read it into a set[enum]. For those
  that have such an input feed whose contents may come from external/remote
  sources, this is a potential DoS vulnerability.

  #1487
  #1488

This release fixes the following bugs:

• Fix mime type detection bug in IRC/FTP file_transferred event for file
  data containing null-bytes

  #1430

• Fix potential for missing timestamps in SMB logs

  #1436

• Remove use of LeakSanitizer API on FreeBSD where it's unsupported

  #1440

• Fix incorrect parsing of ERSPAN Type I

  #1445
  f53fb9a

• Fix incorrect/overflowed n value for SSL_Heartbeat_Many_Requests notices
  where number of server heartbeats is greater than number of client heartbeats.

  #1454
  #1459
  c23e3ca

• Fix missing user_agent existence check in smtp/software.zeek
  (causes reporter.log error noise, but no functional difference)

  #1455
  83d5b44

• Fix include order of bundled headers to avoid conflicts with
  pre-existing/system-wide installs

  #1465

• Fix musl build (e.g. Void, Alpine, etc.)

  #1469
  2ad4825

• Fix build with -DENABLE_MOBILE_IPV6 / ./configure --enable-mobile-ipv6

  #1493
  #1495

• Add check for null packet data in pcap IOSource, which is an observed state
  in Myricom libpcap that crashes Zeek via null-pointer dereference

  #1498

• Allow CRLF line-endings in Zeek scripts and signature files

  #1497
  #1499

• Fix armv7 build

  #1496
  #1502

• Fix unserialization of set[function], generally now used by connection
  record removal hooks, and specifically breaking intel.log of Zeek clusters

  #1506
  #1513

• Fix indexing of set/table types with a vector

  #1514

• Fix precision loss in ASCII logging/printing of large double, time, or
  interval values

  #1450
  #1494

• Improve handling of invalid SIP data before requests

  #1507
  #1511

• Fix copy()/cloning vectors that have holes (indices w/ null values)

  180ab31

Reminder: Zeek 4.0.x is a Long-Term Support (LTS) release, receiving bug fixes until at least May 2022 (estimate of 2 months after 5.0.0 release).