Suricata NULL Dereference Vulnerability in TLS ALPN Rule Keyword

A NULL dereference vulnerability has been identified in Suricata, a network IDS, IPS, and NSM engine, affecting versions 8.0.0 prior to 8.0.4. The issue arises when the 'tls.alpn' rule keyword is used, leading to a crash. This vulnerability has been patched in Suricata version 8.0.4.

Impact

Exploitation of this vulnerability causes Suricata to crash due to a NULL dereference, disrupting its network monitoring and intrusion detection capabilities.

Remediation

Users can upgrade to Suricata version 8.0.4 to address this vulnerability. Alternatively, rules using the 'tls.alpn' keyword can be disabled, although no known rules in common rulesets currently use this keyword.