OSSEC changelog (4.2.0) support@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

• @atomicturtle
• @Hu6li

Release Notes

This release focuses on analysisd scalability and broader stability. Key enhancements include an always-on multi-threaded analysisd pipeline for Linux servers, pthread migration for manager daemons, rootcheck file-hash enrichment in alerts, and a self-contained Windows agent installer that ships required MinGW/OpenSSL runtime DLLs. It also includes numerous fixes across authd, maild, syscheck, logcollector, and rules.

Security Fixes

• @atomicturtle – PR 2216 – Fix ossec-authd failure under modern Linux crypto policies (RHEL 8+)
• @atomicturtle – PR 2219 – Fix ossec-maild heap corruption when building alert email bodies

General

• @atomicturtle – PR 2214 – Migrate manager daemons to pthreads and add shared thread pool support
• @atomicturtle – PR 2220 – Keep ossec-maild running when SMTP is temporarily unavailable
• @atomicturtle – PR 2228 – Validate agent keys with OS_IsValidIP for IPv6 authd -i keys
• @atomicturtle – PR 2232 – Indicate when report_changes diffs are truncated (#455)
• @atomicturtle – PR 2236 – Update stale IIS and Windows doc URLs in setup helpers (#1975)
• @Hu6li – PR 2244 – Append MD5/SHA1/SHA256 hashes of detected rootcheck files to alerts
• @atomicturtle – PR 2246 – Multi-threaded analysisd event pipeline for Linux servers
• @atomicturtle – PR 2247 – Bundle MinGW/OpenSSL runtime DLLs in the Windows agent installer (#2241)

Bug Fixes

• @atomicturtle – PR 2217 – Fix memory leak in analysisd OS_IsValidIP path (#2108)
• @atomicturtle – PR 2218 – Fix agent getaddrinfo failures on RHEL 8+ by retrying with IPv4
• @atomicturtle – PR 2221 – Fix Windows agent ignoring configured notify_time for keep-alives
• @atomicturtle – PR 2223 – Fix logcollector memory leak when duplicate localfiles are configured
• @atomicturtle – PR 2225 – Fix wrong CloseHandle on Windows realtime duplicate hash path
• @atomicturtle – PR 2226 – Fix frequency rule alert context showing unrelated log lines (#1079)
• @atomicturtle – PR 2227 – Fix incomplete syscheck baseline database population (#1248)
• @atomicturtle – PR 2229 – Fix syscheck diff false errors and snapshot handling (#1296)
• @atomicturtle – PR 2230 – Restore rule.group in JSON alert output (#1838)
• @atomicturtle – PR 2231 – Fix authd graceful SIGINT/SIGTERM shutdown (#919)
• @atomicturtle – PR 2233 – Honor localfile command frequency after logcollector restart (#1415)
• @atomicturtle – PR 2234 – Restore linear scan fallback for syscheck db lookups (#1248)
• @atomicturtle – PR 2235 – Poll journald continuously instead of on command frequency (#2110)
• @atomicturtle – PR 2237 – Fix false CIS apt sources alert on Ubuntu 24.04
• @atomicturtle – PR 2238 – Fix false dpkg install alert when removing packages
• @atomicturtle – PR 2239 – Fix msauth Enterprise Admins false positives and negatives
• @atomicturtle – PR 2240 – Fix Postfix rule 3331 false positive on postscreen client ports
• @atomicturtle – PR 2243 – Fix AIX agent entropy failure after chroot by keeping OS RNG usable

View on GitHub