CVE-2012-5642: High severity fail2ban vulnerability
server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content.
Other sources
The release notes for fail2ban 0.8.8 [1],[2] indicate:
[83109bc] IMPORTANT: escape the content of <matches> (if used in custom action files) since its value could contain arbitrary symbols. Thanks for discovery go to the NBS System security team
This could cause issues on the system running fail2ban as it scans log files, depending on what content is matched. There isn't much more detail about this issue than what is described above, so I think it may largely depend on the type of regexp used (what it matches) and the contents of the log file being scanned (whether or not an attacher could insert something that could be used in a malicious way).
The upstream git commit [3].
[1] https://raw.github.com/fail2ban/fail2ban/master/ChangeLog [2] http://sourceforge.net/mailarchive/message.php?msgid=30193056 [3] https://github.com/fail2ban/fail2ban/commit/83109bc
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5642?
CVE-2012-5642 is classified as a moderate severity vulnerability that could potentially allow remote attackers to trigger unsafe behavior in a custom action file.
How do I fix CVE-2012-5642?
To fix CVE-2012-5642, upgrade to Fail2ban version 0.8.8 or later, where the vulnerability has been addressed.
What versions of Fail2ban are affected by CVE-2012-5642?
CVE-2012-5642 affects Fail2ban versions prior to 0.8.8, including all versions up to 0.8.7.1.
What kind of attacks can be executed using CVE-2012-5642?
Attackers can exploit CVE-2012-5642 to manipulate the content of the matches tag leading to unsafe actions specified in custom action files.
Is there any workaround for CVE-2012-5642?
There are no official workarounds for CVE-2012-5642, and users are strongly advised to upgrade to the patched version.