{"id":"CVE-2026-63347","aliases":["DEBIAN-CVE-2026-63347","UBUNTU-CVE-2026-63347","USN-8766-1"],"status":"published","title":"suricata-update vulnerability","description":"[Unknown description]","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-17T15:49:45.873417611Z","modified":"2026-10-06T15:00:08Z","fixes":[{"ecosystem":"Debian:12","package":"suricata-update","fixed_in":["1.2.7-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"suricata-update","fixed_in":["1.3.4-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"suricata-update","fixed_in":["1.3.8-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"suricata-update","fixed_in":["1.2.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"suricata-update","fixed_in":["1.3.0-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"suricata-update","fixed_in":["1.3.7-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-1+deb12u1"}]}],"versions":["1.2.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-1+deb13u1"}]}],"versions":["1.3.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-1"}]}],"versions":["1.3.4-1","1.3.6-1","1.3.6-1~exp1","1.3.7-1","1.3.7-2","1.3.7-2~bpo13+1","1.3.8-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1ubuntu0.1~esm1"}]}],"versions":["1.2.1-1","1.2.2-1","1.2.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.1~esm1"}]}],"versions":["1.3.0-1","1.3.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7-2ubuntu0.1~esm1"}]}],"versions":["1.3.4-1","1.3.6-1","1.3.7-1","1.3.7-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1ubuntu0.1~esm1"}]}],"versions":["1.2.1-1","1.2.2-1","1.2.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2ubuntu0.1~esm1"}]}],"versions":["1.3.0-1","1.3.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"suricata-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7-2ubuntu0.1~esm1"}]}],"versions":["1.3.4-1","1.3.6-1","1.3.7-1","1.3.7-2"]}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63347","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63347","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63347","tags":["report"]},{"url":"https://github.com/OISF/suricata-update/security/advisories/GHSA-6v4p-4w5x-9fp2","tags":["report"]},{"url":"https://redmine.openinfosecfoundation.org/issues/8633","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8766-1","tags":["advisory"]}],"sources":{"osv":[{"id":"DEBIAN-CVE-2026-63347","status":"published","published":"2026-08-17T15:49:45.873417611Z","modified":"2026-10-06T15:00:08.549604277Z","updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-63347","description":"[Unknown description]","status":"published","published":"2026-08-18T00:00:00Z","modified":"2026-09-15T20:16:41.386206743Z","updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"USN-8766-1","title":"suricata-update vulnerability","description":"Guillem Lefait discovered that Suricata-Update did not properly validate\ndestination paths when extracting files referenced by downloaded rule\narchives. An attacker could possibly use this issue to write arbitrary\nfiles outside the configured rules directory.","status":"published","published":"2026-09-15T15:14:27Z","modified":"2026-09-16T02:57:26.010170098Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}