Wazuh v4.14.7 released
By SecBurg
Wazuh is a free and open-source XDR/SIEM platform used to monitor, detect and respond to threats across endpoints and cloud workloads.
Version 4.14.7 landed, again focused on security hardening and bugfixes across manager, agent and ruleset:
Manager
Removed
Removed deprecated wazuh-dbd daemon and database_output configuration. (#37035)
Fixed
Improved cluster payload buffer allocation strategy. (#37280)
Improved cluster archive decompression limits. (#37119)
Improved cluster worker file path validation. (#36998)
Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. (#37034)
Updated aiohttp, cryptography, PyJWT, python-multipart and starlette Python dependencies. (#37361)
Agent
Fixed
Fixed AWS SQS subscriber wodle resolving the wrong AWS account for cross-account iam_role_arn configurations. (#36791)
Fixed agent keepalive scheduling after a system clock rollback causing false Disconnected status. (#36338)
Fixed eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023. (#37014)
Fixed eBPF FIM whodata missing file move/rename events into monitored folders. (#37023)
Added IP address validation to the ip-customblock active response to prevent malformed input in file path operations. (#36730)
Added a null check for inode and device fields in the FIM whodata event handler. (#37245)
Ruleset
Fixed
Fixed multiple Debian, Ubuntu and Windows SCA checks generating incorrect results. (#37385)
Fixed a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as permissive. (#36361)
Fixed the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling. (#36396)
Fixed the /etc/gshadow- permissions SCA check always failing due to an incorrect all condition. (#36795)
Fixed a macOS SCA PolicyBanner check false failure by wrapping the command in sh -c for glob expansion. (#36783)
RESTful API
Fixed
Fixed TypeError when sorting agents by version with empty version strings. (#37323)
Improved sensitive data masking in cluster configuration endpoint. (#37039)
Check the installation guide for upgrade instructions.