4.2.0
OSSEC changelog (4.2.0) support@atomicorp.com
Release Maintainers
Dan Parriott
Scott R. Shinn (https://www.atomicorp.com)
Contributors on this release
- @atomicturtle
- @Hu6li
Release Notes
This release focuses on analysisd scalability and broader stability. Key enhancements include an always-on multi-threaded analysisd pipeline for Linux servers, pthread migration for manager daemons, rootcheck file-hash enrichment in alerts, and a self-contained Windows agent installer that ships required MinGW/OpenSSL runtime DLLs. It also includes numerous fixes across authd, maild, syscheck, logcollector, and rules.
Security Fixes
- @atomicturtle – PR 2216 – Fix ossec-authd failure under modern Linux crypto policies (RHEL 8+)
- @atomicturtle – PR 2219 – Fix ossec-maild heap corruption when building alert email bodies
General
- @atomicturtle – PR 2214 – Migrate manager daemons to pthreads and add shared thread pool support
- @atomicturtle – PR 2220 – Keep ossec-maild running when SMTP is temporarily unavailable
- @atomicturtle – PR 2228 – Validate agent keys with OS_IsValidIP for IPv6 authd -i keys
- @atomicturtle – PR 2232 – Indicate when report_changes diffs are truncated (#455)
- @atomicturtle – PR 2236 – Update stale IIS and Windows doc URLs in setup helpers (#1975)
- @Hu6li – PR 2244 – Append MD5/SHA1/SHA256 hashes of detected rootcheck files to alerts
- @atomicturtle – PR 2246 – Multi-threaded analysisd event pipeline for Linux servers
- @atomicturtle – PR 2247 – Bundle MinGW/OpenSSL runtime DLLs in the Windows agent installer (#2241)
Bug Fixes
- @atomicturtle – PR 2217 – Fix memory leak in analysisd OS_IsValidIP path (#2108)
- @atomicturtle – PR 2218 – Fix agent getaddrinfo failures on RHEL 8+ by retrying with IPv4
- @atomicturtle – PR 2221 – Fix Windows agent ignoring configured notify_time for keep-alives
- @atomicturtle – PR 2223 – Fix logcollector memory leak when duplicate localfiles are configured
- @atomicturtle – PR 2225 – Fix wrong CloseHandle on Windows realtime duplicate hash path
- @atomicturtle – PR 2226 – Fix frequency rule alert context showing unrelated log lines (#1079)
- @atomicturtle – PR 2227 – Fix incomplete syscheck baseline database population (#1248)
- @atomicturtle – PR 2229 – Fix syscheck diff false errors and snapshot handling (#1296)
- @atomicturtle – PR 2230 – Restore rule.group in JSON alert output (#1838)
- @atomicturtle – PR 2231 – Fix authd graceful SIGINT/SIGTERM shutdown (#919)
- @atomicturtle – PR 2233 – Honor localfile command frequency after logcollector restart (#1415)
- @atomicturtle – PR 2234 – Restore linear scan fallback for syscheck db lookups (#1248)
- @atomicturtle – PR 2235 – Poll journald continuously instead of on command frequency (#2110)
- @atomicturtle – PR 2237 – Fix false CIS apt sources alert on Ubuntu 24.04
- @atomicturtle – PR 2238 – Fix false dpkg install alert when removing packages
- @atomicturtle – PR 2239 – Fix msauth Enterprise Admins false positives and negatives
- @atomicturtle – PR 2240 – Fix Postfix rule 3331 false positive on postscreen client ports
- @atomicturtle – PR 2243 – Fix AIX agent entropy failure after chroot by keeping OS RNG usable