CVE-2017-15377

In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default).

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2017-10-23

Last modified

2024-08-05

Affected products

• Suricata (Openinfosecfoundation)

References

• https://github.com/OISF/suricata/commit/b9579fbe7dd408200ef03cbe20efddb624b73885
• https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html
• https://redmine.openinfosecfoundation.org/issues/2231