4.2.0

OSSEC changelog (4.2.0) support@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

• @atomicturtle
• @Hu6li

Release Notes

This release focuses on analysisd scalability and broader stability. Key enhancements include an always-on multi-threaded analysisd pipeline for Linux servers, pthread migration for manager daemons, rootcheck file-hash enrichment in alerts, and a self-contained Windows agent installer that ships required MinGW/OpenSSL runtime DLLs. It also includes numerous fixes across authd, maild, syscheck, logcollector, and rules.

Security Fixes

• @atomicturtle - PR 2216 - Fix ossec-authd failure under modern Linux crypto policies (RHEL 8+)
• @atomicturtle - PR 2219 - Fix ossec-maild heap corruption when building alert email bodies

General

• @atomicturtle - PR 2214 - Migrate manager daemons to pthreads and add shared thread pool support
• @atomicturtle - PR 2220 - Keep ossec-maild running when SMTP is temporarily unavailable
• @atomicturtle - PR 2228 - Validate agent keys with OS_IsValidIP for IPv6 authd -i keys
• @atomicturtle - PR 2232 - Indicate when report_changes diffs are truncated (#455)
• @atomicturtle - PR 2236 - Update stale IIS and Windows doc URLs in setup helpers (#1975)
• @Hu6li - PR 2244 - Append MD5/SHA1/SHA256 hashes of detected rootcheck files to alerts
• @atomicturtle - PR 2246 - Multi-threaded analysisd event pipeline for Linux servers
• @atomicturtle - PR 2247 - Bundle MinGW/OpenSSL runtime DLLs in the Windows agent installer (#2241)

Bug Fixes

• @atomicturtle - PR 2217 - Fix memory leak in analysisd OS_IsValidIP path (#2108)
• @atomicturtle - PR 2218 - Fix agent getaddrinfo failures on RHEL 8+ by retrying with IPv4
• @atomicturtle - PR 2221 - Fix Windows agent ignoring configured notify_time for keep-alives
• @atomicturtle - PR 2223 - Fix logcollector memory leak when duplicate localfiles are configured
• @atomicturtle - PR 2225 - Fix wrong CloseHandle on Windows realtime duplicate hash path
• @atomicturtle - PR 2226 - Fix frequency rule alert context showing unrelated log lines (#1079)
• @atomicturtle - PR 2227 - Fix incomplete syscheck baseline database population (#1248)
• @atomicturtle - PR 2229 - Fix syscheck diff false errors and snapshot handling (#1296)
• @atomicturtle - PR 2230 - Restore rule.group in JSON alert output (#1838)
• @atomicturtle - PR 2231 - Fix authd graceful SIGINT/SIGTERM shutdown (#919)
• @atomicturtle - PR 2233 - Honor localfile command frequency after logcollector restart (#1415)
• @atomicturtle - PR 2234 - Restore linear scan fallback for syscheck db lookups (#1248)
• @atomicturtle - PR 2235 - Poll journald continuously instead of on command frequency (#2110)
• @atomicturtle - PR 2237 - Fix false CIS apt sources alert on Ubuntu 24.04
• @atomicturtle - PR 2238 - Fix false dpkg install alert when removing packages
• @atomicturtle - PR 2239 - Fix msauth Enterprise Admins false positives and negatives
• @atomicturtle - PR 2240 - Fix Postfix rule 3331 false positive on postscreen client ports
• @atomicturtle - PR 2243 - Fix AIX agent entropy failure after chroot by keeping OS RNG usable