wazuh-manager 3.2.3: Segmentation fault in ossec-maild

[iasdeoupxe]

Hi *,

i've just updated the wazuh-manager from 3.2.2 to 3.2.3 on a Debian stretch/stable installation and merged the new changes from ossec.conf.new into my ossec.conf. When starting wazuh-manager afterwards the following is showing up:

Mai 29 21:26:15 example.com env[19834]: Started ossec-execd...
Mai 29 21:26:15 example.com env[19834]: Segmentation fault
Mai 29 21:26:15 example.com env[19834]: ossec-maild did not start correctly.
Mai 29 21:26:15 example.com systemd[1]: wazuh-manager.service: Control process exited, code=exited status=1
Mai 29 21:26:15 example.com systemd[1]: Failed to start Wazuh manager.
Mai 29 21:26:15 example.com systemd[1]: wazuh-manager.service: Unit entered failed state.
Mai 29 21:26:15 example.com systemd[1]: wazuh-manager.service: Failed with result 'exit-code'.

I did some digging and found out that the segmentation fault is caused by the following line in the <global></global> part of ossec.conf.new:

<queue_size>131072</queue_size>

which got raised in the scope of https://github.com/wazuh/wazuh/pull/676 from:

<queue_size>16384</queue_size>

When removing this line (lowering the value again doesn't help) the ossec-maild starts up again without the segmentation fault.

[chemamartinez]

Hi @iasdeoupxe,

I am sorry for the inconvenience, we found a problem when parsing the ossec-maild configuration. It has already been solved in this commit (https://github.com/wazuh/wazuh/commit/fe3fecf7e3e6613ff36be8e3d5e2cbfff90615a2) and we hope it is available as soon as possible.

Meanwhile, you can remove the <queue_size> tag from the configuration and Wazuh will use the default value.

Thank you for your contribution!

Best regards,
Chema.

[jesuslinares]

Hi @iasdeoupxe,

This bug is fixed (https://github.com/wazuh/wazuh/commit/fe3fecf7e3e6613ff36be8e3d5e2cbfff90615a2) and it will be released soon.

Description

New installations will include the <queue_size> setting in the global section. Maild doesn't parse this setting properly and it is closed automatically.

It doesn't affect the upgrades since the configuration is not changed.

Temporary remediation

Remove the <queue_size> setting from the configuration.

Thanks,
Jesus.

[iasdeoupxe]

Thanks for the quick reply and the great insights into this. Will check the next release and close the issue accordingly if it is fixed.

[iasdeoupxe]

Updating to wazuh-manager 3.2.4 fixed this issue. Thanks again.