Wazuh v4.14.8 released
By SecBurg
Wazuh is an open-source XDR/SIEM platform for threat detection, monitoring and incident response across endpoints and cloud workloads.
Version 4.14.8 is out, bringing lots of security fixes for the manager and API, FIM eBPF whodata improvements and ruleset corrections:
Manager
Fixed
Fixed AES connection getting reset to blowfish on keystore rebuild. (#37524)
Fixed a deadlock in wazuh-analysisd that stopped alert generation when the Active Response queue filled up. (#37764)
Restricted the upgrade commands accepted from the agent message channel in Analysisd. (#37745)
Added destination path validation when deleting rule and decoder files. (#37838)
Added source path validation when retrieving CDB list files. (#37901)
Added path validation when listing and deleting CDB list files. (#38214)
Fixed the aws-s3 wodle failing to parse configuration values that contain spaces, such as discard_regex, discard_field, aws_profile, aws_account_alias, path and path_suffix. (#37929)
Fixed wazuh-db exiting the worker thread instead of closing the peer socket when an oversized message is received. (#37850)
Improved SCA policy source validation to correctly enforce the sca.remote_commands restriction. (#37953)
Added a minimum length check for legacy-format agent messages in wazuh-remoted. (#38099)
Fixed a spurious StarletteDeprecationWarning printed by agent_upgrade at startup. (#38085)
Fixed a spurious StarletteDeprecationWarning printed by cluster_control and other framework CLI tools at startup. (#38412)
Fixed the API login attempt limit not being applied consistently under concurrent requests. (#38135)
Fixed a heap buffer write in wazuh-analysisd when generating FIM alerts by resizing full_log before writing. (#38145)
Fixed password validation not being enforced for empty passwords in the update_user API endpoint. (#38180)
Fixed API tokens for run_as users not being invalidated on logout or role revocation. (#38193)
Fixed a remote-command configuration validation bypass where upper- or mixed-case XML element names let command localfile and wodle blocks pass the remote_commands restriction. (#38239)
Agent
Changed
Improved SCA policy YAML parsing to bound memory usage on deeply nested policies. (#37725)
Fixed
Prevent a race condition in randombytes during the initialization of the Windows RSA key container (#37701)
Fixed missing macOS SSH authentication logs by adding the sshd-session and sshd-auth processes to the default Unified Logging query. (#37769)
Fixed the name, version and PyPI packages reported for Microsoft Store Python installations. (#37441)
Fixed the FIM eBPF whodata provider swapping the reported user_id and group_id in every event. (#39358)
Fixed FIM eBPF whodata attributing every file change to root when the kernel reports no loginuid. (#39335)
Added
Added audit_uid, audit_name, audit_gid, and audit_group_name fields to FIM whodata alerts generated by the eBPF provider. (#32467)
Ruleset
Fixed
Fixed Fortigate Decoder, malicious ioc rule and RHEL 8,9,10 incorrect rpm check. (#37434)
Fixed typo in /etc/security/opasswd permission check on Debian 10, Ubuntu 20.04 and Ubuntu 22.04 SCA rules. (#37652)
Fixed the LLMNR SCA check expected value on Windows Server 2016 and 2012. (#37765)
Fixed typo in /etc/shells permission check on Debian 10, Ubuntu 20.04 and Ubuntu 22.04 SCA rules. (#37770)
Fixed MITRE ATT&CK tactic IDs being used instead of technique IDs in Microsoft Graph rules. (#37950)
Fixed FortiAuth decoders mapping to incorrect fields. (#38195)
Check the full release notes and the installation guide for upgrade instructions.
Happy scanning! :-)