CyberRota Analysis
AI-GeneratedSuricata versions prior to 7.0.16 are vulnerable to a denial-of-service attack due to a NULL dereference in the Lua TLS certificate information helper when processing crafted TLS traffic with missing certificate fields. This vulnerability can lead to crashes in the Intrusion Detection and Prevention System, impacting network security monitoring. Organizations using affected versions should prioritize updating to 7.0.16 or modifying Lua scripts to handle missing certificate fields to mitigate potential disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (`TlsGetCertInfo` function), or update scripts to handle missing certificate fields where possible.