Wazuh v4.14.9 released
By SecBurg
Wazuh is an open-source XDR/SIEM platform for threat detection, monitoring and incident response across endpoints and cloud workloads.
Version 4.14.9 is out and it is a big maintenance release with dozens of fixes across manager, agent and ruleset.
On the security side, Linux binaries now ship with proper compiler hardening (stack canary, PIE, full RELRO, FORTIFY_SOURCE). The cluster server and wazuh-authd no longer keep pre-authentication connections open forever, and several wodles (Azure Graph, GitHub, Office 365, MS Graph) are restricted to their configured API host, so authentication tokens can’t leak to another host. The fluent-forward module now verifies the Fluentd server identity, and control characters in the API access log are escaped to prevent log forging.
Other highlights:
Memory leak fixed in the wazuh-analysisd JSON decoder, integer issues fixed in OS_StrBreak()
Fixed active response disable-account reporting success when nothing was disabled, usernames are now allowlisted
Windows netsh and route-null active responses fixed (broken since v4.14.7)
Several FIM eBPF whodata fixes, now also usable on capable kernels older than 5.8 such as RHEL 8.10
Windows MSI upgrade no longer breaks when a restart is pending
Default FIM config fixed on macOS (/private/etc) and Windows (critical binaries were not monitored)
Many SCA fixes, including checks that always passed or silently failed
Embedded Python updated to 3.10.21
Check the full release notes and the installation guide for the complete changelog and upgrade instructions.
Happy scanning! :-)