zeek/zeek v8.2.2

on GitHub

Thank you to Peter Cullen (@pbcullen), Stefan Goetz (@stefangoetzcorelight), Jan Grashöfer
(@J-Gras), Eldon Koyle (@ekoyle), Simeon Miteff (simeonmiteff), Kara Zaffarano and Kyle
Elliott of Trail of Bits in collaboration with OpenAI, AdaLogics in collaboration with
Anthropic, and the Canadian Communications Security Establishment for their contributions
to this release.

This release fixes the following security issues:

• HIGH: SMB: Chains of AndX messages can crash Zeek
  Advisory: GHSA-2xc9-g36m-w7jh

• HIGH: DNP3: Memory exhaustion via file control (g70v1) fields
  Advisory: GHSA-px95-jfxw-4jw2

• HIGH: SIP: Memory exhaustion from long request/response paths
  Advisory: GHSA-wjf9-326g-m9h3

• HIGH: DHCP: Memory exhaustion from retained options after analyzer violation
  Advisory: GHSA-hxj7-pcq9-c949

• HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries
  Advisory: GHSA-49x5-fmqq-4ccv

• HIGH: SMB: DCE/RPC memory exhaustion from fragment state
  Advisory: GHSA-rmc2-mqq6-wcw9

• HIGH: Analyzer manager: Equivalent scheduled analyzers could exhaust memory
  Advisory: GHSA-3gxr-8f49-vrgr

• HIGH: ZIP: Unbounded decompression
  Advisory: GHSA-2prm-q48h-m96w

• HIGH: Redis: Parsed Redis traffic memory exhaustion
  Advisory: GHSA-c573-w89f-fpxm

• HIGH: Invalid IPv6 fragments can lead to unbounded state growth
  Advisory: GHSA-84jg-cwr7-4p6w

• HIGH: SSH: Quadratic KEX algorithm CPU exhaustion
  Advisory: GHSA-5v93-pm35-5mq6

• HIGH: NVT: Oversized line recovery writes before heap buffer
  Advisory: GHSA-hww6-p5xp-6rqv

• HIGH: DHCP: Unbounded state growth via join_data
  Advisory: GHSA-qf53-234m-7vhq

• HIGH: FTP: Unbounded state growth via ftp_data_expected
  Advisory: GHSA-9m23-gwjx-p3j8

• HIGH: OCSP: Empty byName responder ID crashes Zeek
  Advisory: GHSA-j48p-9pm3-pgpx

• HIGH: ARP: Tunneled ARP traffic crashes Zeek
  Advisory: GHSA-924m-g9gv-45xc

• HIGH: LDAP: Unbounded per-connection script state
  Advisory: GHSA-pxc9-fc9v-r39q

• HIGH: IRC DCC SEND has unbounded state growth
  Advisory: GHSA-5h5v-fcxr-f223

• HIGH: tunnel_changed event limit bypass on direct/tunneled toggles
  Advisory: GHSA-72qh-gpq9-cj8w

• HIGH: Recursive stack exhaustion from deep packet analyzer chains
  Advisory: GHSA-vh6p-7vxf-m7rh

• MEDIUM: Telnet: AUTH STATUS options before a NAME is received results in event argument mismatch
  Advisory: GHSA-qjhc-rfmf-3vgp

• MEDIUM: UDP: udp_contents events could trigger out-of-bounds reads
  Advisory: GHSA-q48f-3qm2-j875

• MEDIUM: NetBIOS: Memory exhaustion from declared session lengths
  Advisory: GHSA-gq9q-85wf-mq48

• MEDIUM: IRC: Single DCC Send packet can result in scripting error
  Advisory: GHSA-6566-755c-7mwq

• MEDIUM: IRC: Invalid DCC Send host/port fields can lead to unexpected parsing results
  Advisory: GHSA-q6c5-95ff-cwr9

This release fixes the following bugs:

• IN_ANYWHERE is now allowed as a wildcard in Intel files for the interface field.

• The Prometheus service discovery endpoint for the telemetry framework was not rendering
  IPv6 addresses correctly.

• The unknown_protocols.log previously included the IP next protocol field
  as a 16 bit value, with the first byte value set to the next protocol followed
  by a zero byte due to a spurious use of htons(). This has been fixed to be
  just the next protocol byte.

• Fixed file descriptors of the WebSocket server and WebSocket client connections
  (Cluster::listen_websocket()) being inherited by child processes. E.g., when using
  system() in Zeek scripts or the Input Framework's raw reader functionality.