CVE-2024-28870: 
Suricata vulnerability analysis and mitigation

CVE-2024-28870 affects Suricata, a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. The vulnerability was disclosed on April 2, 2024, and affects versions up to 6.0.16 and 7.0.0 through 7.0.3. The issue has been patched in versions 6.0.17 and 7.0.4 (GitHub Advisory).

The vulnerability occurs when parsing an overly long SSH banner, which can trigger excessive CPU resource consumption and generate excessive logging volume in alert records. The issue has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) (GitHub Advisory, NVD).

The primary impact of this vulnerability is on system availability through excessive resource consumption. When exploited, the vulnerability can cause the system to use excessive CPU resources and generate an unusually high volume of alert records, potentially affecting system performance and storage capacity (GitHub Advisory).

The vulnerability can be exploited remotely without requiring any privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit by sending malformed SSH traffic with overly long banners (GitHub Advisory).

Several workarounds are available if immediate patching is not possible: 1) Use a rule to bypass the flow when an overly long SSH banner arrives, 2) Disable the SSH parser, 3) Set a low stream.reassembly.depth value, or 4) Disable EVE SSH logging. The recommended solution is to upgrade to version 6.0.17 or 7.0.4, which contain the security fix (GitHub Advisory).