https://vulnerability.circl.lu/sightings/feed 2026-07-23T14:21:15.463207+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a0e5e79f-791c-454d-8fe8-2ce6b99eb9f9/export 2026-07-23T14:21:15.811731+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a0e5e79f-791c-454d-8fe8-2ce6b99eb9f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63134", "type": "seen", "source": "https://infosec.exchange/users/mmguero/statuses/116964108001076474", "content": "Malcolm v26.07.1 adds a few minor changes on top of Malcolm v26.07.0, the most notable being a fix for a crash in the strelka-backend container on arm64 platforms. Malcolm v26.07.0 added IEC 60870-5-104 (IEC 104) protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improves NetBox enrichment configuration; and addresses PostgreSQL major version upgrade, custom CA certificate for KeyCloak, container health check, privilege-drop signal chaining, and configuration script issues. Arkime, Zeek, Fluent Bit, Filebeat, Logstash, Supercronic, and Alpine-based images have been updated as well.\nIf you are upgrading from an existing Malcolm installation, run ./scripts/status for Malcolm to migrate some settings prior to running ./scripts/configure, ./scripts/start, or other Malcolm control scripts.\nhttps://github.com/idaholab/Malcolm/compare/v26.06.1...v26.07.1\n\n\n\u2728 Features and enhancements\n\nAdd IEC 60870-5-104 (IEC 104) support using the CERT.LV spicy-iec104 Zeek plugin, including Zeek log ingestion, ECS field mapping, Arkime fields, and an IEC 104 dashboard #939\nMake LOGSTASH_NETBOX_ENRICHMENT_DATASETS more flexible: it now accepts default, ics/ot, all, explicit provider.dataset values, and combinations such as default,ics #1037\nAllow LOGSTASH_NETBOX_ENRICHMENT_DATASETS to be configured through checkboxes in the configuration TUI #1033\nImprove ./scripts/start error messages by listing missing or invalid authentication-related files instead of reporting only a generic authentication setup failure #865\nHave system-quickstart detect and prepopulate existing time synchronization settings when rerun #992\n\n\ud83d\udee1\ufe0f Security Remediation & Hardening\n\nFix an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer CVE-2026-63177 #1042\nFix path traversal in archive extraction directory handling by validating resolved paths and using libarchive's secure extraction flags CVE-2026-63134 #1040\nLimit archive entry count, nesting depth, and total expanded size to prevent inode- and resource-exhaustion denial of service during extraction CVE-2026-63133 #1041\nMark OpenID Connect session cookies as secure and improve handling of externally forwarded HTTPS schemes\n\n\ud83d\udc1b Bug fixes\n\nCo-installation of opencv-python and opencv-contrib-python corrupts cv2.abi3.so, segfaulting strelka-backend at import on arm64 #1046 (fix)\nAllow the configuration TUI to reset supported variables back to empty values after installation #1024, #1030\nFix the broken signal chain in docker-uid-gid-setup.sh so signals reach the final process after dropping privileges #1039 to ensure clean shutdown of containers\nFix PostgreSQL being reported unhealthy after a major-version upgrade, improve upgrade-state handling, and perform required post-upgrade extension and collation maintenance #1038\nFix the Nginx Lua/OpenID Connect helper not honoring user-provided CA certificates for KeyCloak when KEYCLOAK_SSL_VERIFY=true #1035\nRestore curl to the the htadmin container for use by the health check script #1029\nReduce the size of the OpenSearch Dashboards image by copying only the permissions data needed from its upstream image layer #1031\nFix JSON handling of several Zeek fields whose names contain dots by normalizing them to underscore-separated field names\nFix additional Zeek and Suricata field normalization and ECS mapping inconsistencies found while updating dashboards and index templates\n\n\u2705 Component version updates\n\nArkime to v6.6.0\n\nThis update contains a major speed-up when loading the SPIView and Connections pages\nZeek to v8.2.1 #970\nFluent Bit Windows installer helper to v5.0.9\nFilebeat OSS to v9.4.3\nLogstash to v9.4.4\nPillow (Python library used in the netbox container) to v12.3.0 to address several security findings\nSupercronic to v0.2.47\nAlpine Linux base images to v3.24\nKeyCloak to 26.6.4\ncryptography (Python library) to v48.0.1 to address security advisory GHSA-537c-gmf6-5ccf\n\n\ud83e\uddf9 Code and project maintenance\n\nBroad spelling, grammar, naming consistency, and documentation cleanup across scripts, configuration, dashboards, and documentation #990\nExpand and restructure documentation to provide better project context for developers and LLM-assisted code analysis #964\n\nMalcolm Dashboard Reference\nSearch Queries in Arkime and OpenSearch Dashboards\nImprove installer validation, environment-variable mapping tests, and configuration item metadata\nRefresh dashboards, index templates, field mappings, protocol documentation, and navigation links\nMinor improvements to the Hedgehog Raspberry Pi image build process.\n\n\ud83d\udcc4 Configuration changes for Malcolm (in environment variables in ./config/). The Malcolm control script (e.g., ./scripts/status, ./scripts/start) automatically handles creation and migration of variables according to ./config/env-var-actions.yml.\n\nLOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env now defaults to default and may contain default, ics/ot, all, explicit provider.dataset values, or a comma-separated combination of these values\nZEEK_DISABLE_ICS_IEC104 in zeek.env controls whether the IEC 104 Zeek plugin is disabled\nSAFE_EXTRACT_MAX_ENTRIES, SAFE_EXTRACT_MAX_DEPTH, and SAFE_EXTRACT_MAX_BYTES in upload-common.env set archive extraction resource limits for uploaded archive files (e.g., containing Zeek logs for processing); their defaults are 5,000 entries, 20 directory levels, and 4 GiB of expanded data\nMalcolm is a powerful, easily deployable network \ud83d\udda7 traffic analysis tool suite for network security monitoring \ud83d\udd75\ud83c\udffb\u200d\u2640\ufe0f.\nMalcolm operates as a cluster of containers \ud83d\udce6, isolated sandboxes which each serve a dedicated function of the system. This makes Malcolm deployable with frameworks like Docker \ud83d\udc0b, Podman \ud83e\uddad, and Kubernetes \u2388. Check out the Quick Start guide for examples on how to get up and running.\nAlternatively, dedicated official ISO installer images \ud83d\udcbf for Malcolm and Hedgehog Linux \ud83e\udd94 can be downloaded from Malcolm's releases page on GitHub. Due to limits on individual files in GitHub releases, these ISO files have been split \ud83e\ude93 into 2GB chunks and can be reassembled with scripts provided for both Bash \ud83d\udc27 (release_cleaver.sh) and PowerShell \ud83e\ude9f (release_cleaver.ps1). See Downloading Malcolm - Installer ISOs for instructions.\nAs always, join us on the Malcolm discussions board \ud83d\udcac to engage with the community, or pop some corn \ud83c\udf7f and watch a video \ud83d\udcfc.\n#Malcolm #HedgehogLinux #Zeek #Arkime #Strelka #NetBox #OpenSearch #Elasticsearch #Suricata #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #OT #ICS #icssecurity #CyberSecurity #Cyber #Infosec #INL", "creation_timestamp": "2026-07-22T14:30:53.561768Z"} 2026-07-22T14:30:53.561768+00:00