v4.10.4
Wazuh v4.10.4
Added 1
- Added detection of the -a never,task Audit rule in FIM whodata for Linux
Changed 5
- Masked authd.pass in configuration API responses for users without update permissions
- Changed sync primitive disposal to stop and soften teardown failures
- Updated curl dependency to 8.12.1
- Updated starlette dependency to 0.49.1
- Upgraded Python embedded interpreter to 3.10.19
Fixed 6
- Fixed analysisd plugin decoder argument alignment
- Fixed admin protection in update user endpoint
- Fixed protected settings checks when multiple ossec_config blocks are present
- Improved cluster file synchronization path handling by adding safe path joins
- Fixed Vulnerability Detector offset DB update to occur only after processing
- Fixed Windows FIM Registry scan crash on non-null-terminated values
Security 4
- Fixed path traversal in authd via agent group name validation
- Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling
- Fixed DAPI callable resolution to restrict invocations to exposed resources only
- Restricted cluster file transfer write paths
Manager
Changed
- Masked
authd.passin configuration API responses for users without update permissions. (#34128)
Fixed
- Fixed analysisd plugin decoder argument alignment. (#35222)
- Fixed path traversal in authd via agent group name validation. (#35258)
- Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling. (#35256)
- Fixed DAPI callable resolution to restrict invocations to exposed resources only. (#35256)
- Fixed admin protection in update user endpoint. (#35469)
- Fixed protected settings checks when multiple
<ossec_config>blocks are present. (#34690) - Restricted cluster file transfer write paths. (#34659)
- Improved cluster file synchronization path handling by adding safe path joins. (#35008)
- Fixed Vulnerability Detector offset DB update to occur only after processing (backport from 4.12.0). (#31901)
Agent
Added
- Added detection of the
-a never,taskAudit rule in FIM whodata for Linux. (#34661)
Changed
- Changed sync primitive disposal to stop and soften teardown failures. (#34680)
Fixed
- Fixed Windows FIM Registry scan crash on non-null-terminated values. (#34679)