Wazuh v4.14.8 Security Advisory: Fixes Heap Overflow, Config Bypass, and API Auth Issues

Vulnerability Overview Version v4.14.8 of Wazuh resolves multiple security-related issues, including connection resets, deadlocks, configuration validation, API login restrictions, password verification, and remote command configuration validation. Scope of Impact Manager: Affects AES connections, Active Response queues, upgrade commands, configuration parsing, CDB file handling, peer connections, SCA policies, API login, password verification, and remote command configuration. Agent: Affects Windows RSA key container initialization, macOS SSH authentication logging, Python package reporting, FIM eBPF whodata, and FIM eBPF whodata file change ownership attribution. Ruleset: Affects Fortigate decoders, permission checks, LLMNR SCA checks, MITRE ATT&CK tactic IDs, and FortiAuth decoders. Remediation Steps Manager Fixes the issue where AES connections were reset during keystore reconstruction. Fixes a deadlock in that halted alert generation when the Active Response queue was full. Restricts upgrade commands accepted from the agent message channel. Adds validation for target paths when deleting rules and decoders files. Adds validation for source paths when retrieving CDB files. Adds path validation when listing and deleting CDB files. Fixes an issue in the module when parsing configuration values containing specific spaces. Fixes an issue where exited its worker thread upon receiving oversized messages. Improves SCA policy source validation to correctly enforce restrictions. Adds a minimum length check for legacy-format agent messages. Fixes a printed at startup. Fixes a printed at startup. Fixes an issue where API login attempt limits were not consistently applied in concurrent requests. Fixes a heap buffer overflow in that occurred when resizing before writing while generating FIM alerts. Fixes an issue where empty password verification was not enforced in the API endpoint. Fixes an issue where tokens were not invalidated upon logout or role revocation. Fixes a remote command configuration validation bypass where case-insensitive XML element names allowed the and blocks to circumvent restrictions. Agent Improves SCA policy YAML parsing to limit memory usage for deeply nested policies. Prevents race conditions during initialization for Windows RSA key containers. Fixes missing macOS SSH authentication logs by adding and processes to the default unified log query. Fixes the name, version, and PyPI package reporting for Microsoft Store Python installations. Fixes an issue where the FIM eBPF whodata provider swapped the reported and . Fixes an issue where FIM eBPF whodata attributed every file change to the root directory when the kernel reported no login. Adds , , , and fields to FIM whodata alerts. Ruleset Fixes issues with the Fortigate decoder, malicious IOC rules, and incorrect RPM checks for RHEL 8.9.10. Fixes a typo in permission checks for in Debian 10, Ubuntu 20.04, and Ubuntu 22.04 SCA rules. Fixes the expected values for LLMNR SCA checks on Windows Server 2016 and 2012. Fixes a typo in permission checks for in Debian 10, Ubuntu 20.04, and Ubuntu 22.04 SCA rules. Fixes the MITRE ATT&CK tactic IDs used in Microsoft Graph rules. Fixes an issue where the FortiAuth decoder mapped to incorrect fields. Proof of Concept (PoC) Code or Exploit Code No PoC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Wazuh v4.14.8 Security Advisory: Fixes Heap Overflow, Config Bypass, and API Auth Issues

More from this source