4.2.0

[atomicturtle]

OSSEC changelog (4.2.0) support@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

• @atomicturtle
• @Hu6li

Release Notes

This release focuses on analysisd scalability and broader stability. Key enhancements include an always-on multi-threaded analysisd pipeline for Linux servers, pthread migration for manager daemons, rootcheck file-hash enrichment in alerts, and a self-contained Windows agent installer that ships required MinGW/OpenSSL runtime DLLs. It also includes numerous fixes across authd, maild, syscheck, logcollector, and rules.

Security Fixes

• @atomicturtle - PR 2216 - Fix ossec-authd failure under modern Linux crypto policies (RHEL 8+)
• @atomicturtle - PR 2219 - Fix ossec-maild heap corruption when building alert email bodies

General

• @atomicturtle - PR 2214 - Migrate manager daemons to pthreads and add shared thread pool support
• @atomicturtle - PR 2220 - Keep ossec-maild running when SMTP is temporarily unavailable
• @atomicturtle - PR 2228 - Validate agent keys with OS_IsValidIP for IPv6 authd -i keys
• @atomicturtle - PR 2232 - Indicate when report_changes diffs are truncated (report_changes should indicate if diff was truncated in notification #455)
• @atomicturtle - PR 2236 - Update stale IIS and Windows doc URLs in setup helpers ([Documentation] Broken Links #1975)
• @Hu6li - PR 2244 - Append MD5/SHA1/SHA256 hashes of detected rootcheck files to alerts
• @atomicturtle - PR 2246 - Multi-threaded analysisd event pipeline for Linux servers
• @atomicturtle - PR 2247 - Bundle MinGW/OpenSSL runtime DLLs in the Windows agent installer (Ossec Agent Installation on Windows - ERROR #2241)

Bug Fixes

• @atomicturtle - PR 2217 - Fix memory leak in analysisd OS_IsValidIP path (ossec-analysisd leaks memory. #2108)
• @atomicturtle - PR 2218 - Fix agent getaddrinfo failures on RHEL 8+ by retrying with IPv4
• @atomicturtle - PR 2221 - Fix Windows agent ignoring configured notify_time for keep-alives
• @atomicturtle - PR 2223 - Fix logcollector memory leak when duplicate localfiles are configured
• @atomicturtle - PR 2225 - Fix wrong CloseHandle on Windows realtime duplicate hash path
• @atomicturtle - PR 2226 - Fix frequency rule alert context showing unrelated log lines (Frequency and/or counter issue #1079)
• @atomicturtle - PR 2227 - Fix incomplete syscheck baseline database population (syscheck not complete database #1248)
• @atomicturtle - PR 2229 - Fix syscheck diff false errors and snapshot handling (ossec-syscheckd: ERROR: Unable to run diff #1296)
• @atomicturtle - PR 2230 - Restore rule.group in JSON alert output (JSON EventInfo output missing "group" field in "rule" object #1838)
• @atomicturtle - PR 2231 - Fix authd graceful SIGINT/SIGTERM shutdown (Provide mechanism for graceful exit of ossec-authd #919)
• @atomicturtle - PR 2233 - Honor localfile command frequency after logcollector restart (localfile command frequency is ignored when logcollector restarts #1415)
• @atomicturtle - PR 2234 - Restore linear scan fallback for syscheck db lookups (syscheck not complete database #1248)
• @atomicturtle - PR 2235 - Poll journald continuously instead of on command frequency (Journald read in 1001 seconds bursts #2110)
• @atomicturtle - PR 2237 - Fix false CIS apt sources alert on Ubuntu 24.04
• @atomicturtle - PR 2238 - Fix false dpkg install alert when removing packages
• @atomicturtle - PR 2239 - Fix msauth Enterprise Admins false positives and negatives
• @atomicturtle - PR 2240 - Fix Postfix rule 3331 false positive on postscreen client ports
• @atomicturtle - PR 2243 - Fix AIX agent entropy failure after chroot by keeping OS RNG usable

---

This discussion was created from the release 4.2.0.