CVE-2021-45098
High
Description
An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it's possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client's request. These packets will not trigger a Suricata reject action.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Oisf Suricata
PublishedDec 16, 2021
First seenDec 16, 2021
How to fix
Update
- oisf suricata6.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oisf suricata | v < 6.0.4 | 6.0.4 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.