Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes
CrowdSec 1.8.0 adds WAF bot detection via challenges and fingerprinting and fixes denial-of-service flaws in HTTP and Kubernetes audit datasources.
CrowdSec 1.8.0, released August 31, introduces bot detection in its WAF using client challenges and fingerprinting, plus fixes for two denial-of-service vulnerabilities in the HTTP acquisition datasource (unbounded decompressed body size, trusted Content-Length) and the Kubernetes audit webhook datasource (unbounded request body reads). The release also adds a dedicated Kubernetes datasource pulling logs directly from the apiserver, new HTTP helpers for external queries in the expression language, and performance work on the decisions stream endpoint. The challenge requires SSE4.1 and writable-executable memory, so some legitimate visitors may be blocked.
- Bot detection stays off by default and requires SSE4.1, potentially blocking some legitimate visitors.
- Two DoS fixes bound decompressed HTTP body sizes and unbounded Kubernetes audit webhook reads.
- New dedicated Kubernetes datasource pulls logs directly from the apiserver.
- New HTTP helpers in the expression language let parsers query external services during decisions.
- Vendors
- CrowdSec
- Products
- CrowdSec 1.8.0
- Organizations
- CrowdSec
From the original article
2 min read at helpnetsecurity.com
Failed SSH logins pile up in an auth log, and a scanner walks a website looking for exposed admin paths. CrowdSec reads log sources and HTTP requests, works out which addresses are misbehaving, and hands the block to a separate remediation component sitting in front of the service. Users report what they see back to the project, which curates it into a community blocklist every installation can pull down.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.