Upcoming patch release bug fixes

[jsiwek]

A collection of bugs/backports to potentially address in upcoming patch releases (e.g. 4.0.x). They get marked done when they are confirmed/backported into a release branch (e.g. release/4.0).

Zeek 6.2.2

• Fix compilation error with GCC 14 due to missing header broker#413
• Fix cid propagation into files.log #3710

Zeek 6.0.5

• Fix cid propagation into files.log #3710

[jsiwek]

Past releases:

Zeek 6.2.1

• docs/python: Point users at WebSocket broker#398
• Fix ICMP caplen violations that could trigger out-of-bounds buffer access in rule matching #3706
• Gracefully handle empty shadow files #3693
• Add PacketFilter::remove_exclude function #3691
• Support for configurable localversion (rebased version) #3690

Zeek 6.0.4

• Update Mozilla CA and Google CT list and related tests. #3621
• Disable SSE, AVX and AVX2 and FMA flags if OS has XSAVE disabled google/highwayhash#122 (would be nice, but I'm not sure when that's merged)
• Fix ICMP caplen violations that could trigger out-of-bounds buffer access in rule matching #3706
• Gracefully handle empty shadow files #3693
• Add PacketFilter::remove_exclude function #3691
• docs/python: Point users at WebSocket broker#398
• Support for configurable localversion (rebased version) #3690

Zeek 6.1.1

• Cannot unload/load plugins with Zeek 6.1 - __zeek_plugin__ not recognized package-manager#171
• Fix HTTP signature framework not supporting '$' #3428 (TBD, but seems reasonable and was user-reported and user-fixed)
• Add jq to dockerfile #3454 (TBD)
• SSL: Add new extension types and ECH test #3423
• DNS: Add Ed25519 and Ed448 enum values to parser #3465
• CMakeLists: Fix OPENSSL_INCLUDE_DIR reference (for release/6.0) #3469
• Pick up upstream CAF patch for flow::from_steps broker#382
• [Bugfix] Changed the deprecated SafeConfigParser attribute to ConfigParser zeekctl#61 (zeekctl not functioning on Fedora 39)
• smb: Fix &read_expire not in effect due to &default=string_set() usage #3511
• FindZeek: Split --include_dirs on colon instead of space cmake#104 (community found)
• spicy_add_analyzer: Depend on CXX_LINK arg cmake#103 (slightly annoying for CXX_LINK users)
• Dict: Invalidate iterators during Clear() #3537
• Known: Keep &create_expire on local tables/sets valid #3541
• Make sure Spicy symbols are available. #3565

Zeek 6.0.3

• Fix HTTP signature framework not supporting '$' #3428 (TBD, but seems reasonable and was user-reported and user-fixed)
• Add jq to dockerfile #3454 (TBD)
• SSL: Add new extension types and ECH test #3423
• DNS: Add Ed25519 and Ed448 enum values to parser #3465
• CMakeLists: Fix OPENSSL_INCLUDE_DIR reference (for release/6.0) #3469
• Pick up upstream CAF patch for flow::from_steps broker#382
• [Bugfix] Changed the deprecated SafeConfigParser attribute to ConfigParser zeekctl#61 (zeekctl not functioning on Fedora 39)
• smb: Fix &read_expire not in effect due to &default=string_set() usage #3511
• FindZeek: Split --include_dirs on colon instead of space cmake#104 (community found)
• spicy_add_analyzer: Depend on CXX_LINK arg cmake#103 (slightly annoying for CXX_LINK users)
• Dict: Invalidate iterators during Clear() #3537
• Known: Keep &create_expire on local tables/sets valid #3541
• Make sure Spicy symbols are available. #3565

Zeek 6.0.2

• Fix handling of module scope when checking exported Spicy types for collisions #3292
• Allow injecting env vars into spicyz invocation in spicy_add_analyzers cmake#92
• Update zeekjs submodule to v0.9.6 #3302 (Fix segfaults for zeek.invoke and zeek.event corelight/zeekjs#72, Nodejs: Unset kNoInitializeCppgc for Node 20.6 or higher corelight/zeekjs#73, Nodejs: Do not use UV_RUN_DEFAULT during InitPostScript() corelight/zeekjs#74)
• DNS_Mgr::GetNextTimeout(): ares_fds: __GI___fortify_fail / "buffer overflow detected" #3309 (and follow-up DNS_Mgr: Fix | vs & for pollfd.revents #3336)
• Broker-backed tables don't support deletion for complex index types. #3342
• Cut a new spicy-1.8.x patch release spicy#1557
• Do not require cookie for reject_protocol during teardown. #3323
• event: Reinitialize EventMgr's flare after fork() from stem #3394
• Fix mmdb pointer destruction #3393 / Fix mmdb pointer destruction + tests #3401
• Update CMake submodule for caching fix #3400

Zeek 6.0.1

• fix http AUTHORIZATION base64 decode failed #3152
• Nice-to-have: Build can accidentally pick up external Spicy installation #3153
• Nice-to-have: Prefer to find spicy-config in configured over default search paths. cmake#84
• [Spicy] Support switch fields when exporting Spicy types to Zeek. #3165
• Define early_shutdown lambda earlier in zeek-setup, avoids build failure with gperftools #3173
• Regression: Zeek 6 writes __bro_plugin__ without trailing newline #3175
• Attempt to protect from unbounded DCE-RPC state #3158
• Do not forward more than the remaining data to downstream UDP analyzer #3206 (reported/found by user on Slack)
• Do not forward padding to downstream TCP packet analyzer #3213 (same as Do not forward more than the remaining data to downstream UDP analyzer #3206 but for TCP, thanks Johanna)
• Explicitly link Zeek executable against Spicy libraries in binary packaging mode. #3226
• Connection flipping recreates c$id, removing extra fields #3028 (if considered safe and worth it - reported to be hit by users on Slack)
• Problematic behavior for enabling community id in notice.log #3242
• Fix check for emailed notices #3269
• DNS_Mgr: Fixes around timeouts and IO loop behavior #3273

Zeek 5.0.10

• Add trigger_mgr to iosource_mgr later during startup #2848 (Segfault triggered from LookupHostCallback during shutdown #2846) (should've been included in 5.0.8)
• Socks5 dpd sig fix #3102
• Fix check for emailed notices #3269
• DNS_Mgr: Fixes around timeouts and IO loop behavior #3273

Zeek 5.2.2

• Reimplement fixes to handle commas at the end of config parser lines #2948
• tp_vlan_tci not masked by 0xfff for setting vlan zeek-af_packet-plugin#60 (af-packet)
• AF_Packet: Check interface for upness zeek-af_packet-plugin#56 (af-packet, will get when bumping for the above)
• readthedocs: Fix urllib3/openssl issue zeek-docs#184

Zeek 5.0.9

• Zeek 5.0.8 for Fedora 38 #2974 / Build fails on GCC 13 spicy#1416
• Bump Spicy to latest release. #2995
• Bump the OpenSUSE Tumbleweed CI image to get gcc 13 #3009
• readthedocs: Fix urllib3/openssl issue zeek-docs#184

Zeek 5.2.1

• Default known stores to false to avoid Broker stores #2831
• BinPAC: Ensure zeek/src/include is added to BinPAC include path cmake#63
• Add trigger_mgr to iosource_mgr later during startup #2848 (Segfault triggered from LookupHostCallback during shutdown #2846)
• ScriptValidation: Make break/next a warning until Zeek 6.1 #2839 (ja3 has been fixed, we may ditch this one)
• Bump spicy plugin to v1.5.2+
• Fix the x509-invalid-extension test on OpenSSL 3.1 #2870
• PktSrc: Avoid calling ExtractNextPacketInternal() in GetNextTimeout() #2859
• Call AnalyzerConfirmation earlier in the process for VXLAN and Geneve #2778
• Fix forwarding of tunnelled packets #2912
• Consider cap len when forwarding into packet analysis. #2907
• PktSrc: Introduce Pcap::non_fd_timeout #2913 (TBD, but can be leveraged to significantly lower CPU usage in low-packet-rate environments with non-selectable packet sources)
• Fix a long-standing bug in the math around continue_processing #2927

Zeek 5.0.8

• Default known stores to false to avoid Broker stores #2831
• Add ZeekPortWarning plugin zeekctl#51
• Fix re-instantiation of analyzers that were just removed. #2821
• RDP Keyboard Parsing #2700
• Sidestep handling HTTP 0.9 replies, avoiding analyzer violation #2851
• HTTP: Reset reply_message for HTTP/0.9 #2863
• HTTP: Make Content-Range parsing more robust #2864
• Bump spicy-plugin to v1.3.26+
• Bump spicy-plugin to v1.3.24. #2835
• Fix the x509-invalid-extension test on OpenSSL 3.1 #2870
• GH-2684: Stop violating VXLAN for forwarding failures #2718
• Call AnalyzerConfirmation earlier in the process for VXLAN and Geneve #2778
• Fix forwarding of tunnelled packets #2912
• Consider cap len when forwarding into packet analysis. #2907
• PktSrc: Avoid calling ExtractNextPacketInternal() in GetNextTimeout() #2859
• PktSrc: Introduce Pcap::non_fd_timeout #2913 (TBD, but can be leveraged to significantly lower CPU usage in low-packet-rate environments with non-selectable packet souces)
• Fix a long-standing bug in the math around continue_processing #2927

Zeek 5.0.7

• Don't specify the version of openssl in ci/macos/prepare.sh #2769
• Bump spicy-plugin to v1.3.23. #2774
• Fix issues due to signed/unsigned char discrepancies #2746
• btest/decode_base_errors: Avoid binary output in baseline #2754
• HashKey: Do not call Describe() unconditionally in DEBUG mode #2780
• Move get_relative_seq and get_segment_len to public static methods #2790

Zeek 5.1.2

• input: Add location info for invalid enums #2619 (nice-to-have)
• Fix ZAM memory leak #2679
• intel/seen/file-names: Use file_over_new_connection() #2652
• packet_analysis: Do not raise analyzer_confirmation per-packet for tunnels #2437 (Important perf fix for tunneled mirror traffic - this was somehow missed. It's in 5.0.x already)
• smb1: Prevent accessing uninitialized referenced_tree #2733
• "error: Duplicate &is_used attribute is ambiguous" with multiple eval stmts in signatures #2628
• notice: fa_file related changes (multiple and no connection cases) #2632
• Rework TeredoAnalyzer::DetectProtocol to not catch as many packets #2702
• Add a few extra length checks to Teredo::DetectProtocol #2732
• updated hyperlink to external SMB resource zeek-docs#168
• Single CPU performance regression 4.2 vs 5.0 for zeek -r #2454

Zeek 5.0.6

• input: Add location info for invalid enums #2619 (nice-to-have)
• intel/seen/file-names: Use file_over_new_connection() #2652
• updated hyperlink to external SMB resource zeek-docs#168
• notice: fa_file related changes (multiple and no connection cases) #2632
• Single CPU performance regression 4.2 vs 5.0 for zeek -r #2454
• smb1: Prevent accessing uninitialized referenced_tree #2733

Zeek 5.0.5

• Update broker to 2.3.6 to fix Python 3.11 build failures

Zeek 5.1.1

• Logging outages with Zeek 5 #2389 (partially fixed)

Zeek 5.0.4

• Logging outages with Zeek 5 #2389 (partially fixed)

Zeek 5.1

• Bump spicy-plugin to v1.3.21. #2506
• Fix messaging between clone and proxy broker#283
• Topic/jasonlu/dict clone performance #2478 (Fixes copy() of table with 10mio (and 5.0mio and 2.3mio) entries: fatal error: Dictionary (size 1452082) insertion distance too far: 65535 #2386 and Runtime of copy() for tables of different sizes varies hugely #2387)
• Update DNS type strings to match correct mappings #2531

Zeek 5.0.3

• Fix messaging between clone and proxy broker#283
• Update CAF submodule broker#284
• Add toplevel build dir to PATH for dev helper scripts. #2470
• zeek/zeek-docs@ec1e4e7 (needs to be pulled back into all of the 5.0 releases)
• Topic/jasonlu/dict clone performance #2478 (Fixes copy() of table with 10mio (and 5.0mio and 2.3mio) entries: fatal error: Dictionary (size 1452082) insertion distance too far: 65535 #2386 and Runtime of copy() for tables of different sizes varies hugely #2387)
• IPBasedAnalyzer/TCPSessionAdapter: Fix TCP reassembly decision for known port analyzers #2502
• packet_analysis: Do not raise analyzer_confirmation per-packet for tunnels #2437
• fix for deprecated when's where the inner frame is larger than the outer frame #2434
• Bump spicy-plugin to v1.3.21. #2506
• Update DNS type strings to match correct mappings #2531

Zeek 5.0.2

• Update CAF submodule broker#275
• Fix error handling with OpenSSL calls broker#278
• Pause signal-masking during script parsing and stop masking when running unit tests #2253

Zeek 5.0.1

• GH-2229: Fix some typos in weak-keys.zeek #2233
• Fix default build with --disable-cpp-tests. #2256
• Avoid calling safe_realloc unnecessarily from ODesc::Grow() #2244
• Remove use of fallible get_conn_transport_proto in analyzer_violation. #2288
• Remove spammy reporter log message for IP packets: 40b1452
• Workers fail to peer with proxies taking a long time to start #2334
• Use correct variable to pass existing Spicy root to spicy-plugin. #2364
• Bump Spicy dependencies to spicy-1.5.1 and spicy-plugin-1.3.17. #2368
• Avoid race conditions in broker.ssl_auth_failure btest #2372
• ARP, Modbus, IP packet conversion, and DNS security issues

[timwoj]

Zeek 3.0.14

• Fix null-pointer dereference when encountering an invalid enum name in a config/input file that tries to read it into a set[enum]
  Segfault in 4.0.0 - not-valid-enum - SerialTypes.cc:564 #1487
  GH-1487: Handle error from ValueToVal instead of ignoring it #1488

Zeek 3.0.13

• MIME sub-entities overwriting top-level header values cause misleading SMTP log
  GH-1352: Added flag to stop processing SMTP headers in attached messages #1365
  ZEEK SMTP Header Parsing Issue #1352
• Fix major_subsys_version field in pe_optional_header event
  Fix major_subsys_version field in pe_optional_header event #1401
• Fix ASCII Input reader's treatment of input files containing null-bytes
  Null bytes in ASCII input reader #1398
  a636f8e

Zeek 3.2.4

• MIME sub-entities overwriting top-level header values cause misleading SMTP log
  GH-1352: Added flag to stop processing SMTP headers in attached messages #1365
  ZEEK SMTP Header Parsing Issue #1352
• Fix major_subsys_version field in pe_optional_header event
  Fix major_subsys_version field in pe_optional_header event #1401
• Fix ASCII Input reader's treatment of input files containing null-bytes
  Null bytes in ASCII input reader #1398
  a636f8e

Zeek 3.0.12

• Incorrect ICMP Neighbor Discovery Option length calculation
  ICMP Neighbor Discovery: length overflow #1225
  Length overflow in ICMP_Analyzer::BuildNDOptionsVal #1228

• Fix SMB2 response status parsing
  Fix SMB2 response status parsing. Fixes #1286 #1311
  0b8535b
  07c4662

• Fix excessive connection_status_update events for ICMP connections
  Prevent compounding of connection_status_update event timers #1322

Zeek 3.2.3

• Fix EDNS ECS option parsing bugs (stack-overflow / security issue)
  01f1344

• Incorrect ICMP Neighbor Discovery Option length calculation
  ICMP Neighbor Discovery: length overflow #1225
  Length overflow in ICMP_Analyzer::BuildNDOptionsVal #1228

• Fix memory leak in deprecated Analyzer::ConnectionEvent()
  Fix memory leak in deprecated Analyzer::ConnectionEvent() #1294

• Fix SMB2 response status parsing
  Fix SMB2 response status parsing. Fixes #1286 #1311
  0b8535b
  07c4662

• Fix excessive connection_status_update events for ICMP connections
  Prevent compounding of connection_status_update event timers #1322

Zeek 3.0.11

• Fix incorrect RSTOS0 conn_state determinations
  Backscatter/single RST behavior is wrong (conn_state=RSTOS0) #1164
  Fix incorrect RSTOS0 conn_state determinations #1166

• Fix multipart MIME leak of sub-part found after closing-boundary
  98ae204

Zeek 3.2.2

• Fix incorrect RSTOS0 conn_state determinations
  Backscatter/single RST behavior is wrong (conn_state=RSTOS0) #1164
  Fix incorrect RSTOS0 conn_state determinations #1166

• Fix multipart MIME leak of sub-part found after closing-boundary
  98ae204

Zeek 3.0.10

• Fix compilation due to use of C++17 nested namespaces
  54ac0b4

Zeek 3.0.9

• Fix Input Framework 'change' events for 'set' destinations
  Support Input Framework with Sets and Events #1083
  Fix Input Framework 'change' events for 'set' destinations #1087

• Fix reported body-length of HTTP messages w/ sub-entities
  Fix reported body-length of HTTP messages w/ sub-entities #1107

Zeek 3.2.1

• Exclude installing "zeek -> ." include dir symlink
  bc3df06

• Fix build for PowerPC architecture
  Build broken on power architecture #1150
  e8efab5
  05f7e3f

• Fix ftp data-channel minimization function not returning a value
  Fix issue introduced by #1016 (minimize data published by FTP data channel) #1120

• Fix zeek -NN not printing canonical file analyzer names
  Fix issue with canonical names not printing for file analyzers #1136

• Fix closing timestamp of rotated log files in supervised-cluster mode
  99d9a3a

Zeek 3.0.8

• Fix DHCP Client ID Option misformat for Hardware Type 0
  Stop formatting DHCP Client ID Hardware Type 0 as MAC #1003

• Fix/allow copying/cloning of opaque of Broker::Store
  Allow copying/cloning of opaque of Broker::Store #1028

• Fix ConnPolling memory over-use
  reduce memory usage of ConnPolling #1035

• Fix compress_path not normalizing some paths correctly
  compress_path() doesn't normalize some paths correctly #1041
  GH-1041: Move compress_path to a bif that uses normalize_path #1050
  38cd56a

• Fix integer conversion error for Tag subtypes/enums
  Setting "subtype" variable for "analyzer::Component" causes "enum value not found for ..." error! #1062
  fix integer conversion errors related to Tag subtypes #1064

• Fix bro_prng() results not staying within modulus
  Random number generation bugs #1076
  0f4eb9a

• Prevent providing a 0 seed to bro_prng() since the LCG parameters don't allow that
  Random number generation bugs #1076
  887b53b

Zeek 3.1.5

• Fix DHCP Client ID Option misformat for Hardware Type 0
  Stop formatting DHCP Client ID Hardware Type 0 as MAC #1003

• Fix/allow copying/cloning of opaque of Broker::Store
  Allow copying/cloning of opaque of Broker::Store #1028

• Fix ConnPolling memory over-use
  reduce memory usage of ConnPolling #1035

• Fix compress_path not normalizing some paths correctly
  compress_path() doesn't normalize some paths correctly #1041
  GH-1041: Move compress_path to a bif that uses normalize_path #1050

• Fix integer conversion error for Tag subtypes/enums
  Setting "subtype" variable for "analyzer::Component" causes "enum value not found for ..." error! #1062
  fix integer conversion errors related to Tag subtypes #1064

• Fix bro_prng() results not staying within modulus
  Random number generation bugs #1076
  0f4eb9a

• Prevent providing a 0 seed to bro_prng() since the LCG parameters don't allow that
  Random number generation bugs #1076
  887b53b

• Fix mishandling of getrandom() to seed RNG (caused unrandom/deterministic RNG -- opposite of what's desired/intended)
  Random number generation bugs #1076
  dba7643

Zeek 3.0.7

• Limit rate of logging MaxMind DB diagnostic messages
  Limit rate at which MMDB error/status messages are emitted #963

• Fix wrong return value type for topk_get_top() BIF
  Fix the return type of topk_get_top() #996

• Fix opaque Broker types lacking a Type after (de)serialization
  Fix opaque Broker types lacking a Type after (de)serialization #984

• Fix lack of descriptive printing for intervals converted from double_to_interval()
  e17487e

• Fix some cases of known-services not being logged
  Log services with unknown protocols #965
  2f918ed

Zeek 3.1.4

• Fix compilation on Fedora 32 (GCC 10.0.1)
  695457f

• Fix crash when using some deprecated environment variables
  1c08be1

• Fix use on CentOS 6 (Linux kernel < 3.8)
  mheily/libkqueue@8707307

• Limit rate of logging MaxMind DB diagnostic messages
  Limit rate at which MMDB error/status messages are emitted #963

• Fix wrong return value type for topk_get_top() BIF
  Fix the return type of topk_get_top() #996

• Fix opaque Broker types lacking a Type after (de)serialization
  Fix opaque Broker types lacking a Type after (de)serialization #984

• Fix lack of descriptive printing for intervals converted from double_to_interval()
  e17487e

• Fix some cases of known-services not being logged
  Log services with unknown protocols #965
  2f918ed

Zeek 3.0.6

• Fix unusable subscriber.poll() method in Broker Python bindings
  Fix unusable subscriber.poll() method in Python bindings broker#110
• Fix missing default function for Kerberos constant-lookup-tables
  Add default function for Kerberos constant-lookup-tables #918
• Fix uninitialized field access in ssl/log-hostcerts-only.zeek
  check for the existance of f$conns in file_sniff event in ssl/log-hostcerts-only.zeek #916
• Fix cloning of TypeType values
  bug fixes for using "when" in functions that have a local of type "any" #933
• Fix buffer over-read in Ident analyzer
  analyzer/protocol/ident: fix buffer overflow in ParsePort() #925
• Remove misleading error message on empty bloomfilter lookup
  Remove error message from empty bloomfilter lookups #930
• Fix misc/stats.zeek skipping log entry on termination
  ccdaf5f
• Fix SSL scripting error leading to uninitialized field access
  b749dda
• Fix POP3 analyzer global buffer over-read
  280bf56
• Fix potential stack overflows due to use of Variable-Length-Arrays
  Parts of Remove use of Variable-Length-Arrays #912
  • BIFs bytestring_to_hexstr() and hexstr_to_bytestring()
  • socks-analyzer.pac: array_to_string()
  • SMB, NTLM, and RDP analyzers use of utf16_bytestring_to_utf8_val()
  • smb-strings.pac: uint8s_to_stringval() and extract_string()

Zeek 3.1.3

• Fix unusable subscriber.poll() method in Broker Python bindings
  Fix unusable subscriber.poll() method in Python bindings broker#110
• Fix missing default function for Kerberos constant-lookup-tables
  Add default function for Kerberos constant-lookup-tables #918
• Fix uninitialized field access in ssl/log-hostcerts-only.zeek
  check for the existance of f$conns in file_sniff event in ssl/log-hostcerts-only.zeek #916
• Fix cloning of TypeType values
  bug fixes for using "when" in functions that have a local of type "any" #933
• Fix buffer over-read in Ident analyzer
  analyzer/protocol/ident: fix buffer overflow in ParsePort() #925
• Remove misleading error message on empty bloomfilter lookup
  Remove error message from empty bloomfilter lookups #930
• Fix misc/stats.zeek skipping log entry on termination
  ccdaf5f
• Fix SSL scripting error leading to uninitialized field access
  b749dda
• Fix POP3 analyzer global buffer over-read
  280bf56
• Fix potential stack overflows due to use of Variable-Length-Arrays
  Parts of Remove use of Variable-Length-Arrays #912
  • BIFs bytestring_to_hexstr() and hexstr_to_bytestring()
  • socks-analyzer.pac: array_to_string()
  • SMB, NTLM, and RDP analyzers use of utf16_bytestring_to_utf8_val()
  • smb-strings.pac: uint8s_to_stringval() and extract_string()
• Offline pcap processing no longer initializes network_time before first events after zeek_init get dispatched
  1b19090
• Ensure time moves forward when suspending a pcap file IO source
  Ensure time continues moving forward if a pcap source is suspended #950

Zeek 3.0.5

This release is the same as v3.0.4, but additionally fixes compilation on various platforms with older compiler, e.g. GCC 4.8.x (see patch at 3ad1976)

Zeek 3.1.2

• Fix use-after-free in Zeek lambda functions with uninitialized locals
  Use-after-free bug in LambdaExpr #845
• Fix buffer overflow due to tables/records created at parse-time not rebuilt on record redef
  Rebuild dependent table/record values after record redef #860
• Fix SMB NegotiateContextList parsing
  Fix parsing of SMB NegotiateContextList #869
• Fix binpac flowbuffer frame length parsing doing too much bounds checking
  Add test case for binpac flowbuffer frame length parsing bug #873
• Fix parsing ERSPAN III optional sub-header
  42dc290
• Fix bug in intel indicator normalization
  fix-lowercase-intel-bug #883
• Fix connection duration thresholding
  Fix connection duration thresholding #899
• Fix using patterns as table/set indices
  Fix using patterns stored as table/set indices #902
• Fix X509Common.h header include for external plugins
  c835672
• Fix incorrect targeting of node-specific Broker/Cluster messages
  ce9183a
  zeek/broker@0d04bf4
• Fix stack overflow in POP3 analyzer
  bb3250c

Zeek 3.0.4

• Fix use-after-free in Zeek lambda functions with uninitialized locals
  Use-after-free bug in LambdaExpr #845
• Fix buffer overflow due to tables/records created at parse-time not rebuilt on record redef
  Rebuild dependent table/record values after record redef #860
• Fix SMB NegotiateContextList parsing
  Fix parsing of SMB NegotiateContextList #869
• Fix binpac flowbuffer frame length parsing doing too much bounds checking
  Add test case for binpac flowbuffer frame length parsing bug #873
• Fix parsing ERSPAN III optional sub-header
  42dc290
• Fix bug in intel indicator normalization
  fix-lowercase-intel-bug #883
• Fix connection duration thresholding
  Fix connection duration thresholding #899
• Fix X509Common.h header include for external plugins
  c835672
• Fix incorrect targeting of node-specific Broker/Cluster messages
  ce9183a
  zeek/broker@0d04bf4
• Fix stack overflow in POP3 analyzer
  bb3250c

Zeek 3.1.1

• run-time script errors do not pop global frame/call stack
  36557f3
• wrong bro symlink in binary packaging mode
  b324fec
• potential high CPU load due to race in Broker data stores
  Fix a race condition in data store flare operations broker#97
• install full rapidjson include tree, otherwise some external plugins may not compile
  0d97d3f

Zeek 3.0.3

• run-time script errors do not pop global frame/call stack
  36557f3
• wrong bro symlink in binary packaging mode
  b324fec
• potential high CPU load due to race in Broker data stores
  Fix a race condition in data store flare operations broker#97

Zeek v3.0.2

• paraglob v0.3.1
  • use-after-free in paraglob: zeek/paraglob@d65dd0a
  • invalid memory read in paraglob: zeek/paraglob@ac86ce7
  • paraglob compile failure due to non-standard VLA usage: zeek/paraglob@903b5cf
• Broker v1.2.5
  • improve Broker python binding Event validity checks: zeek/broker@2d9f474 via Improve python bindings Event validity checks broker#86
  • misleading Broker debug/error output: zeek/broker@0d136d1
• backport the Cirrus CI config (for better coverage of macOS/FreeBSD): cd9fec7, 52f97c7, 84e3bc7
• malloc/delete mismatch in JSON formatting: c0d6eb9
• leak in OCSP parsing when using OpenSSL 1.1: 2fbcf23
• leak in Kerberos ticket decryption: 53fadb2
• leak when table-based input stream overwrites old entry: 3742e56
• leak in packet filter functions: a961f0b
• leak in system_env() BIF: 273eb19
• leak of Log::Filter "config" field: bf05add
• leak in Reporter::get_weird_sampling_whitelist() BIF: 3b6a2a5
• leaks in input framework error-handling cases: 6f5f7df
• leak when a plugin prevents a log write operation: 09578c6
• leaks due to reference-counting issues in lambdas/closures: 44d922c
  • possibly further lambda/closure issues will be patched via Nested lambdas don't clone properly. #725 (PR Fix logic for finding closure outer ID references #735) (fix not reviewed yet)
  • possible other lambda/closure issues via Closures are not properly maintained across event handlers. #734 (no fix yet)
• NTLM field access scripting error: 80469a1 via fix NTLM field value access #728
• Plugin API returning reference to temporary: ae9e799
• file analysis scripting error via Fix warning when reading files from non-network sources #737: d9ed76c
• fix error handling in decode_base64(): e34562d
  • exposed by above, handle invalid Base64 in FTP ADAT via Handle invalid Base64 encodings in FTP ADAT analyzer #739: 1db7a22
• inconsistent &priority for Log::create_stream() calls: 7a74852 via Use consistent zeek_init priority for Log::create_stream calls #746
• fix SMB transaction data string handling: c75519c via Improve creation of SMB transaction data strings #747
• skip file analysis for zero-length data coming form SSL/TLS analysis: f939bca via Skip file analysis for zero-length SSL/TLS data #748 (weirds also added in merge commit ad18014)
• improve FTP word/whitespace handling: fce4bb3 via Improve FTP word/whitespace handling #749
• improve Kerberos address and event handling: 069eedb via Improve kerberos analyzer address and event handling #753
• binpac cross-compilation configuration fix: d33613c via CMakeLists.txt: fix cross-compilation with binpac #768
• fix miss-formatted input lines preventing future file parsing: Change threading formatter errors to warnings. #777 (nice-to-have, but strictly needed, so skipped as the backporting list this release got a bit long)
• fix indefinite log buffering: 43e54c7 via Prevent log batches from indefinite buffering #781
• ssh analyzer assertion/leak 98c5053 via analyzer/protocol/ssh: fix crash vulnerability after duplicate KEX packet #792
• Dictionary::Clear() didn't reset number of entries: 1e499b0
• leak in DNS TSIG parsing: dd377ff
• leak when creating input streams which use &type_column: 51970c2

[timwoj]

Zeek 4.0.8

• ARP, Modbus, IP packet conversion, and DNS security issues

Zeek 4.0.7

• Coredump - zeek-4.1.0/src/packet_analysis/protocol/ethernet/Ethernet.cc:33 #1751 (backport from 4.2)
• DNS Security Issue

Zeek 4.2.2

• DNS Security Issue

Zeek 4.0.6

• Fix robust iterators when modifying dictionary during iteration. #2040
• Fixes for empty table() constructors #2020 (just the first commit 18fe9d8)
• Add "Reporter" entry to fix plugin hook_name() vs HookType imbalance #2055

Zeek 4.2.1

• Ensure both protocol and analyzer confirmation and violation events can be called #2042
• Fixes for empty table() constructors #2020 (just the first commit 18fe9d8)
• fix & btest for ZAM bug with inlined nested loop #2024
• Reduce interpreter frames for ZAM function bodies #2025
• Re-instantiate providing location information to LoadFile hooks. #2050
• Allow analyzer violations to explicitly set tag. #2043
• Fix robust iterators when modifying dictionary during iteration. #2040
• Fix compile error on GCC-12/Ubuntu 22.04 gen-zam#1 (directly in src/script_opt/ZAM/Gen-ZAM.cc, since not yet in a submodule)
• Add "Reporter" entry to fix plugin hook_name() vs HookType imbalance #2055

Zeek 4.0.5

• Make update-traces fail when the curl invocation fails
  Make update-traces fail when the curl invocation fails #1579
• Bump highwayhash submodule to pull in another FreeBSD header fix #1809
• logging/writers/ascii: shadow files: Add fsync() before rename() #1817
• GH-1768: Properly cleanup existing log stream when recreated on with the same ID #1877
• Fix handling of IP packets with bogus IP header lengths #1569
• Have make dist cleanup a few more wayward files before tarring #1924

Zeek 4.0.4

• Bump Highwayhash submodule to fix FreeBSD 14 build problem
  Bump highwayhash to pull in FreeBSD 14 fix #1680
• Ensure that time gets updated every read loop if reading live traffic
  GH-1684: Ensure that the time gets updated every pass if we're reading live traffic #1690
• Fix a potential infinite loop in RotationTimer
  Fix Infinite loop inside RotationTimer #1689 #1711
• Fix crash when running zeekctl status with StatusCmdShowAll = 1 configured
  Fix addr/string type confusion in Broker::peers() #1734
• Fix a potential evasion of the HTTP analyzer
  Fix HTTP evasion (Issue #1598) #1691
• Fix ignore_checksum_nets not working with multiple subnets
  ignore_checksums_nets: Add test for multiple subnets #1778
  802dfd8
• segfaults/asan errors when using set[string] in record as table key #1753

Zeek 4.1.1

• Fix looping over vectors with holes
  Fix for looping over vectors with holes #1765
• Fix ignore_checksum_nets not working with multiple subnets
  ignore_checksums_nets: Add test for multiple subnets #1778
  802dfd8
• Ensure that time gets updated every read loop if reading live traffic
  GH-1684: Ensure that the time gets updated every pass if we're reading live traffic #1690
• Fix crash when running zeekctl status with StatusCmdShowAll = 1 configured
  Fix addr/string type confusion in Broker::peers() #1734
• segfaults/asan errors when using set[string] in record as table key #1753

Zeek 4.0.3

• Bump Highwayhash to fix FreeBSD build problem
  Broken build on FreeBSD/PowerPC  #1591
• Deprecate Stepping Stone events
  Deprecate stepping-stone analyzer events. #1604
• Robustness improvements to the input framework's handling of unset fields
  Robustness improvements to the input framework's handling of unset fields #1605
• Crash related to broker python bindings when running zeekctl
  Crash related to broker python bindings when running zeekctl broker#187
  Update Broker submodule #1646
  Remove global topic variables broker#191

Zeek 4.0.2

• Fix heap-use-after-free after clear_table() on a table that uses expiration attributes
  d51bd4b
• Add fatal error for if table/Dictionary state ever becomes invalid since the behavior becomes unexpected/unclear at that point (e.g. when table bucket positions become large enough to overflow their 16-bit storage due to aggressive expiration-check settings preventing the re-positioning items)
  292e3e1
• Fix potential Undefined Behavior in decode_netbios_name() and decode_netbios_name_type() BIFs (the later also has a potential heap-buffer-overread).
  Fixes to decode_netbios_name and decode_netbios_name_type BIFs #1533
• Add missing "zeek/" to header includes, which can prevent external plugins from compiling against Zeek source-tree (e.g. via ./configure --zeek-dist=)
  Add missing "zeek/" to header includes #1549
• Fix reading empty set[enum] values and any vector of enum values from config files
  Can't read empty set[enum] values from config files #1555
  Can't read vector of enum types from config files #1558
  Fixes for reading config files with vectors/sets of enums #1559
• Fix type-checks related to list-type equality
  Zeek crash due to apparently insufficient type checking #1296
  fix type-checks related to list-type equality #1358
• Build --enable-mobile-ipv6 on CI
  Build --enable-mobile-ipv6 on CI #1526
• Replace toupper() usages in netbios decoding BIFs
  Replace toupper() usages in netbios decoding BIFs #1563
• Add some extra length checking when parsing mobile ipv6 packets
  5427165

Zeek 4.0.1

• Fix mime type detection bug in IRC/FTP file_transferred event for file data containing null-bytes
  Fix potential mime type detection bug in IRC/FTP file_transferred event #1430
• Fix potential for missing timestamps in SMB logs
  ts fields in SMB logs now default to network_time() #1436
• Remove use of LeakSanitizer API on FreeBSD where it's unsupported
  Prevent use of LeakSanitizer on FreeBSD #1440
• Fix incorrect parsing of ERSPAN Type I
  Fix incorrect parsing of ERSPAN Type I encapsulated messages #1445
  f53fb9a
• Fix incorrect/overflowed n value for SSL_Heartbeat_Many_Requests notices where number of server heartbeats is greater than number of client heartbeats.
  Heartbleed policy Integer overflow #1454
  Heartbleed: fix substraction order #1459
  c23e3ca
• Fix missing user_agent existence check in smtp/software.zeek (causes reporter.log error noise, but no functional difference)
  Sometimes user_agent is missing #1455
  83d5b44
• Fix include order of bundled headers to avoid conflicts with pre-existing/system-wide installs
  Fix include order of bundled header files #1465
• Fix musl build (e.g. Void, Alpine, etc.)
  Fix incomplete-type for struct timeval #1469
  2ad4825
• Fix null-pointer dereference when encountering an invalid enum name in a config/input file that tries to read it into a set[enum]
  Segfault in 4.0.0 - not-valid-enum - SerialTypes.cc:564 #1487
  GH-1487: Handle error from ValueToVal instead of ignoring it #1488
• Fix build with -DENABLE_MOBILE_IPV6 / ./configure --enable-mobile-ipv6
  IP.cc:202:3: error: ‘dump_this_packet’ was not declared in this scope #1493
  GH-1493: Fix build with -DENABLE_MOBILE_IPV6 #1495
• Add check for null packet data in pcap IOSource, which is an observed state in Myricom libpcap that crashes Zeek via null-pointer dereference
  Add a check for null packet data in pcap IOSource #1498
• Allow CRLF line-endings in Zeek scripts and signature files
  support crlf line endings in .zeek parser #1497
  Support CRLF line-endings in Zeek scripts and signature files #1499
• Fix armv7 build
  Error building on FreeBSD 12.2 armv7 #1496
  Fix build on armv7 architecture #1502
• Fix unserialization of set[function], generally now used by connection record removal hooks, and specifically breaking intel.log of Zeek clusters
  Zeek 4 cluster mode not generating intel.log properly #1506
  Fix Broker unserialization of set/table function indices #1513
• Fix indexing of set/table types with a vector
  Fix indexing of set/table types with a vector #1514
• Fix precision loss in ASCII logging/printing of large double, time, or interval values
  Significant delta between TSV and JSON outputs of a time field #1450
  Improve printing/logging of large double/interval/time values #1494
• Improve handling of invalid SIP data before requests
  SIP generating embedded NULL reporter log #1507
  Tolerate junk data before SIP requests #1511
• Fix copy()/cloning vectors that have holes (indices w/ null values)
  180ab31
  Found as part of Restore support for vector "holes" #1512