Summary
Guillem Lefait discovered that Suricata-Update did not properly validate
destination paths when extracting files referenced by downloaded rule
archives. An attacker could possibly use this issue to write arbitrary
files outside the configured rules directory.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | suricata-update | 1.2.3-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | suricata-update | 1.3.0-2ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | suricata-update | 1.3.7-2ubuntu0.1~esm1 |
References
-
report
https://ubuntu.com/security/CVE-2026-63347