chore(container): update wazuh group ( 4.14.3 → 4.14.8 )

[renovate]

This PR contains the following updates:

Package	Update	Change
mirror.gcr.io/wazuh/wazuh-dashboard	patch	4.14.3 → 4.14.8
mirror.gcr.io/wazuh/wazuh-indexer	patch	4.14.3 → 4.14.8
mirror.gcr.io/wazuh/wazuh-manager	patch	4.14.3 → 4.14.8

---

Release Notes

wazuh/wazuh (mirror.gcr.io/wazuh/wazuh-dashboard)

v4.14.8

Compare Source

v4.14.7: Wazuh v4.14.7

Compare Source

Manager

Removed

• Removed deprecated wazuh-dbd daemon and database_output configuration. (#​37035)

Fixed

• Improved cluster payload buffer allocation strategy. (#​37280)
• Improved cluster archive decompression limits. (#​37119)
• Improved cluster worker file path validation. (#​36998)
• Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. (#​37034)
• Updated aiohttp, cryptography, PyJWT, python-multipart and starlette Python dependencies. (#​37361)

Agent

Fixed

• Fixed AWS SQS subscriber wodle resolving the wrong AWS account for cross-account iam_role_arn configurations. (#​36791)
• Fixed agent keepalive scheduling after a system clock rollback causing false Disconnected status. (#​36338)
• Fixed eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023. (#​37014)
• Fixed eBPF FIM whodata missing file move/rename events into monitored folders. (#​37023)
• Added IP address validation to the ip-customblock active response to prevent malformed input in file path operations. (#​36730)
• Added a null check for inode and device fields in the FIM whodata event handler. (#​37245)

Ruleset

Fixed

• Fixed multiple Debian, Ubuntu and Windows SCA checks generating incorrect results. (#​37385)
• Fixed a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as permissive. (#​36361)
• Fixed the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling. (#​36396)
• Fixed the /etc/gshadow- permissions SCA check always failing due to an incorrect all condition. (#​36795)
• Fixed a macOS SCA PolicyBanner check false failure by wrapping the command in sh -c for glob expansion. (#​36783)

RESTful API

Fixed

• Fixed TypeError when sorting agents by version with empty version strings. (#​37323)
• Improved sensitive data masking in cluster configuration endpoint. (#​37039)

v4.14.6: Wazuh v4.14.6

Compare Source

Manager

Removed

• Removed unused SSL/TLS transport option from cluster. (#​35648)

Fixed

• Improved message decompression handling in remoted. (#​35773)
• Improved agent name validation to reject names starting with dot. (#​35833)
• Fixed segfault in vulnerability scanner module shutdown when disabled. (#​36011)
• Fixed string buffer handling in version comparison function. (#​36059)
• Improved cluster file synchronization security. (#​36060)
• Improved cluster file synchronization error handling on invalid task identifiers. (#​36129)
• Improved cluster merged file parameter validation to prevent directory escape. (#​36204)
• Improved tmp_file path validation in cluster DAPI. (#​36246)
• Improved cluster non-merged file path validation during worker file processing. (#​36296)
• Improved cluster node name format validation in the hello handler. (#​36460)
• Fixed missing agent.host.ip in inventory documents when agent IP is empty. (#​35475)
• Fixed stale agent synced status after hot reload on cluster worker nodes. (#​6726)

Agent

Fixed

• Fixed agent registration not running on reinstall after apt-get remove. (#​35727)
• Fixed MS-Graph integration handling for relationships containing /. (#​35431)
• Fixed macOS syscollector to skip package receipts whose payload is no longer installed. (#​35380)
• Fixed missing eBPF create, modify and delete events on Ubuntu 24/26 and improved FIM whodata healthcheck. (#​35838)
• Hardened FIM database path lookups by migrating to parameterized SQL queries. (#​36399)

RESTful API

Fixed

• Escaped control characters in API usernames in access logs. (#​35866)
• Added input validation in cluster result handling and authentication. (#​35757)
• Fixed current user resolution in the update-user endpoint to enforce admin protection. (#​35442)

Ruleset

Fixed

• Updated rootcheck trojan signatures to avoid false positives on modern distributions (Debian 13, Ubuntu 26, Arch Linux). (#​35927)

Other

Changed

• Updated cryptography, urllib3 and python-multipart Python dependencies. (#​35982)
• Updated eBPF libraries: libbpf to 1.7.0 and bpftool to 7.7.0. (#​36467)

Fixed

• Fixed wazuh-manager startup failure on RHEL 10 by dropping the libcrypt dependency from embedded Python. (#​36782)

v4.14.5: Wazuh v4.14.5

Compare Source

Manager

Fixed

• Fixed DAPI callable resolution to restrict invocations to exposed resources only. (#​34889)
• Fixed uncontrolled memory allocation in cluster caused by crafted packet length. (#​35173) (#​35412)
• Fixed rate limit bypass for the /events endpoint. (#​35077)
• Fixed buffer overflow in analysisd regex match processing. (#​35106)
• Fixed path traversal in authd via agent group name validation. (#​35230)
• Fixed size_t underflow in remoted ReadSecMSG causing potential heap overflow. (#​35193)
• Fixed RBAC bypass in DAPI allowing privilege escalation. (#​35307)
• Fixed analysisd plugin decoder argument alignment. (#​35176)

Agent

Fixed

• Fixed rootcheck false positive for /dev/.blkid.tab. (#​34734)
• Fixed ORDER_REVERSAL deadlocks in FIM. (#​34735)
• Fixed Roundcube decoder regex to prevent srcip truncation in "Failed login ... in session" logs. (#​34793)
• Fixed macOS Ventura SCA policy incorrectly passing pmset checks. (#​34693)
• Fixed Office365 integration pagination by trimming HTTP header values. (#​34673)
• Fixed FIM false positives caused by double readdir check. (#​34880)
• Fixed audit log cache overflow for events with many records in logcollector. (#​35285)
• Fixed daily marker for GuardDuty log collector. (#​35110)
• Fixed rootcheck not generating findings. (#​35297)
• Fixed heap buffer overflow in syscheck Registry Wildcard Expansion. (#​35287)

Changed

• Changed RHEL init script with SUSE variant on SLES 11. (#​34563)
• Changed service check from WMI to sc.exe. (#​34543)
• Changed windows syscollector to include command arguments. (#​34727)

RESTful API

Fixed

• Fixed allow_higher_versions validation in API upload_configuration. (#​34905)
• Fixed nested JSON depth limit in API request processing. (#​35224)
• Fixed upload size limit config mismatch. (#​35141)

Ruleset

Fixed

• Fixed bug in CIS SCA checks 35675 and 35689 for Ubuntu 24.04. (#​35088)
• Fixed Dovecot decoders to correctly extract rip and lip fields. (#​35089)

Other

Changed

• Updated dependencies cryptography to 46.0.5, Werkzeug to 3.1.6, pip to 26.0.1 and wheel to 0.46.3. (#​34907)
• Updated embedded Python to 3.10.20 and dependencies pyjwt, pyasn1. (#​35135)
• Updated dependencies cryptography, requests. (#​35331)

v4.14.4: Wazuh v4.14.4

Compare Source

Manager

Fixed

• Fixed heap-based null WRITE Buffer Underflows. (34658)

Agent

Fixed

• Fixed MS Graph default rules not triggering properly. (#​34240)
• Unified date formats in Active Response logs to ensure consistent timestamp formatting. (#​34473)
• Updated Docker integration rules to improve detection coverage and compatibility. (#​34376)
• Fixed heap-based NULL write buffer underflow in GetAlertData. (#​34501)
• Retained MSI installer log after Windows agent upgrade to improve troubleshooting visibility. (#​34517)
• Fixed incorrect Windows 11 edition detection after upgrading the agent to version 4.14.3. (#​34530)
• Fixed macOS agent crash during syscollector reload caused by invalid pthread_cond_destroy() usage. (#​34274)
• Fixed Windows OS edition detection. (34540)
• Fix pthread_mutex_destroy invalid argument error on AIX in syscollector. (#​34900)

Changed

• Changed msi_output extension from txt to log. (34541)
• Changed to unsigned char in print_hex_string. (34602)
• Changed sync primitive disposal to stop and soften teardown failures. (34552)

RESTful API

Fixed

• Fixed timestamps in the /agents/upgrade_result endpoint to return accurate UTC time. (#​34176)
• Improved cluster file synchronization path handling by adding safe path joins. (#​34464)
• Fixed API login race condition- (34459)

Other

Changed

• Updated the azure-core dependency to 1.38.0 and the Werkzeug dependency to 3.1.5. (#​34154)
• Updated the protobuf dependency to 5.29.6 and the python-multipart dependency to 0.0.22. (#​34403)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (4.14.8). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.