There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security
    Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed
    reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been
    addressed in 7.0.7. (CVE-2024-45796)

  - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security
    Monitoring engine. Prior to version 7.0.7, rules using datasets with the non-functional / unimplemented
    "unset" option can trigger an assertion during traffic parsing, leading to denial of service. This issue
    is addressed in 7.0.7. As a workaround, use only trusted and well tested rulesets. (CVE-2024-45795)

  - LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version
    0.5.49, unbounded processing of HTTP request and response headers can lead to excessive CPU time and
    memory utilization, possibly leading to extreme slowdowns. This issue is addressed in 0.5.49.
    (CVE-2024-45797)

  - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security
    Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to
    datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive
    time to load, as well as runtime performance issues during traffic handling. This issue has been addressed
    in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track
    traffic in rules. (CVE-2024-47187)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Suricata 是一個網路入侵偵測系統、入侵防護系統和網路安全監控引擎。 7.0.7版之前遺漏 thash 的隨機種子初始化會導致資料集具有可預測的雜湊表行為。這可導致資料集檔案載入時使用過多的載入時間以及流量處理期間的運行時間效能問題。此問題已在 7.0.7中解決。因應措施為避免從未受信任的來源載入資料集。避免在規則中追踪流量的資料集規則。 (CVE-2024-47187)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

远程主机上安装的 OISF Suricata 低于 6.0.19 版或为低于 7.0.5 的 7.x 版。因此，该软件受到多个漏洞的影响： 

  - 未初始化 thash 的随机种子，这可导致数据集具有可预测的哈希表行为。这可能会造成加载数据集文件时加载时间过长，以及在流量处理期间出现运行时性能问题。(CVE-2024-47187)     
  - 拆分重组期间的逻辑错误可导致有效流量重组失败。攻击者可构造数据包来触发此行为。(CVE-2024-45796)     
  - 使用具有不起作用/未实现的 unset 选项的数据集的规则可在流量解析期间触发断言，从而导致拒绝服务。 (CVE-2024-45795)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  Suricata 是一种网络入侵检测系统、入侵防御系统和网络安全监控引擎。在低于版本 7.0.7的版本中thash 的随机种子缺少初始化导致数据集的哈希表行为可预测。这可导致数据集文件加载使用时过长，并且会在流量处理期间导致运行时性能问题。此问题已在 7.0.7中得到解决。变通方案为避免从不受信任的来源加载数据集。避免在规则中跟踪流量的数据集规则。 (CVE-2024-47187)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

遠端主機上安裝的 OISF Suricata 版本低於 6.0.19，或為低於 7.0.5 的 7.x 版。因此會受到多個弱點影響： 

  - 遺漏 thash 隨機種子的初始化會導致資料集具有可預測的雜湊表行為。這會導致資料集檔案載入時時間過長，以及流量處理期間的執行階段效能問題。(CVE-2024-47187)     
  - 片段重組期間的邏輯錯誤可導致無法重組有效流量。攻擊者可透過特製的封包來觸發此行為。(CVE-2024-45796)     
  - 使用具有無功能/未實作之 unset 選項的資料集的規則可在流量剖析期間觸發宣告，進而導致拒絕服務。(CVE-2024-45795)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Suricata は、ネットワーク侵入検知システム、侵入防止システム、ネットワークセキュリティ監視エンジンです。バージョン 7.0.7より前では、thash のランダムシードの初期化が行われないため、データセットに予測可能なハッシュテーブル動作が発生します。これにより、データセットファイルの読み込みに過剰な時間がかかるだけでなく、トラフィック処理中にランタイムパフォーマンスの問題が発生する可能性があります。この問題は 7.0.7で対処されています。回避策としては、信頼できないソースからデータセットをロードしないようにしてください。ルール内のトラフィックを追跡するデータセットルールを回避します。CVE-2024-47187

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

リモートホストにインストールされている OISF Suricata のバージョンは 6.0.19 より前、または 7.0.5 より前の 7.x です。そのため、以下の複数の脆弱性の影響を受けます。 

  - thash のランダムシードの初期化が欠如しているため、データセットのハッシュテーブルの挙動が予測可能です。これにより、データセットファイルのロードでロードに過剰な時間を費やしたり、トラフィック処理中にランタイムパフォーマンスの問題が発生したりする可能性があります。(CVE-2024-47187)     
  - フラグメント再アセンブリ中の論理エラーにより、有効なトラフィックの再アセンブリが失敗する可能性があります。攻撃者がパケットを細工して、この動作をトリガーする可能性があります。(CVE-2024-45796)     
  - 機能しない / 実装されていない unset オプションのあるデータセットを使用するルールにより、トラフィック解析中にアサーションがトリガーされ、サービス拒否が発生する可能性があります。(CVE-2024-45795)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for thash leads to     datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive     time to load, as well as runtime performance issues during traffic handling. This issue has been addressed     in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track     traffic in rules. (CVE-2024-47187)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of OISF Suricata installed on the remote host is prior to 6.0.19 or 7.x prior to 7.0.5. It is, therefore, affected by multiple vulnerabilities: 

  - Missing initialization of the random seed for thash leads to datasets having predictable hash table behavior. This     can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic     handling. (CVE-2024-47187)     
  - A logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker     could craft packets to trigger this behavior. (CVE-2024-45796)     
  - Rules using datasets with the non-functional / unimplemented unset option can trigger an     assertion during traffic parsing, leading to denial of service. (CVE-2024-45795)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1082 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-47522:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Prior to version 7.0.7, invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is     enabled can lead to Suricata aborting with a panic. This issue has been addressed in 7.0.7. One may     disable ja4 as a workaround.

    CVE-2024-45795:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for thash leads to     byte-range tracking having predictable hash table behavior. This can lead to an attacker forcing lots of     data into a single hash bucket, leading to severe performance degradation. This issue has been addressed     in 7.0.7.

    CVE-2024-47187:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for thash leads to     datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive     time to load, as well as runtime performance issues during traffic handling. This issue has been addressed     in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track     traffic in rules.

    CVE-2024-47188:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed     reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been     addressed in 7.0.7.

    CVE-2024-45796:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Prior to version 7.0.7, rules using datasets with the non-functional / unimplemented     unset option can trigger an assertion during traffic parsing, leading to denial of service. This issue     is addressed in 7.0.7. As a workaround, use only trusted and well tested rulesets.

    CVE-2024-38534:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Crafted modbus traffic can lead to unlimited resource accumulation within a flow.
    Upgrade to 7.0.6. Set a limited stream.reassembly.depth to reduce the issue.

    CVE-2024-38536:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. A memory allocation failure due to `http.memcap` being reached leads to a NULL-ptr     reference leading to a crash. Upgrade to 7.0.6.

    CVE-2024-38535:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Suricata can run out of memory when parsing crafted HTTP/2 traffic. Upgrade to 6.0.20     or 7.0.6.

    CVE-2024-24568:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine.  Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted     traffic. The vulnerability has been patched in 7.0.3.

    CVE-2024-23839:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine.  Prior to 7.0.3, specially crafted traffic can cause a heap use after free if the     ruleset uses the http.request_header or http.response_header keyword.  The vulnerability has been patched     in 7.0.3.  To work around the vulnerability, avoid the http.request_header and http.response_header     keywords.

    CVE-2024-23835:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine.  Prior to version 7.0.3, excessive memory use during pgsql parsing could lead to OOM-     related crashes.  This vulnerability is patched in 7.0.3.  As workaround, users can disable the pgsql app     layer parser.

    CVE-2024-32664:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Prior to 7.0.5 and 6.0.19, specially crafted traffic or datasets can cause a limited     buffer overflow. This vulnerability is fixed in 7.0.5 and 6.0.19. Workarounds include not use rules with     `base64_decode` keyword with `bytes` option with value 1, 2 or 5 and for 7.0.x, setting `app-     layer.protocols.smtp.mime.body-md5` to false.

    CVE-2024-23836:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to     use far more CPU and memory for processing the traffic than needed, which can lead to extreme slow downs     and denial of service.  This vulnerability is patched in 6.0.16 or 7.0.3.  Workarounds include disabling     the affected protocol app-layer parser in the yaml and reducing the `stream.reassembly.depth` value helps     reduce the severity of the issue.

    CVE-2024-37151:
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security     Monitoring engine.
    Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly     failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable     `defrag` to reduce the scope of the problem.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
426247	Alpine: multiple suricata packages: security update to 7.0.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	medium
426247	Alpine: multiple suricata packages: security update to 7.0.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2026/7/2	medium
228990	Linux Distros 未修補的弱點：CVE-2024-47187	Nessus	Misc.	2025/3/5	2026/7/8	high
214273	Suricata < 7.0.7 多个漏洞	Nessus	Misc.	2025/1/16	2026/4/8	medium
228990	Linux Distros 未修补的漏洞：CVE-2024-47187	Nessus	Misc.	2025/3/5	2026/7/8	high
214273	Suricata < 7.0.7 多個弱點	Nessus	Misc.	2025/1/16	2026/4/8	medium
228990	Linux Distros のパッチ未適用の脆弱性: CVE-2024-47187	Nessus	Misc.	2025/3/5	2026/7/8	high
214273	Suricata < 7.0.7 の複数の脆弱性	Nessus	Misc.	2025/1/16	2026/4/8	medium
228990	Linux Distros Unpatched Vulnerability : CVE-2024-47187	Nessus	Misc.	2025/3/5	2026/7/8	high
214273	Suricata < 7.0.7 Multiple Vulnerabilities	Nessus	Misc.	2025/1/16	2026/4/8	medium
239209	TencentOS Server 4: suricata (TSSA-2024:1082)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	high

检测

插件搜索

medium

medium

high

medium

high

medium

high

medium

high

medium

high