REDHAT-BUG-887914: Medium severity fail2ban fail2ban vulnerability
The release notes for fail2ban 0.8.8 [1],[2] indicate:
[83109bc] IMPORTANT: escape the content of <matches> (if used in custom action files) since its value could contain arbitrary symbols. Thanks for discovery go to the NBS System security team
This could cause issues on the system running fail2ban as it scans log files, depending on what content is matched. There isn't much more detail about this issue than what is described above, so I think it may largely depend on the type of regexp used (what it matches) and the contents of the log file being scanned (whether or not an attacher could insert something that could be used in a malicious way).
The upstream git commit [3].
[1] https://raw.github.com/fail2ban/fail2ban/master/ChangeLog [2] http://sourceforge.net/mailarchive/message.php?msgid=30193056 [3] https://github.com/fail2ban/fail2ban/commit/83109bc
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-887914?
The severity of REDHAT-BUG-887914 is classified as important due to potential security implications.
How do I fix REDHAT-BUG-887914?
To fix REDHAT-BUG-887914, ensure that you escape the content of <matches> in custom action files as specified in the fail2ban release notes.
Which software is affected by REDHAT-BUG-887914?
The software affected by REDHAT-BUG-887914 is Fail2ban, specifically version 0.8.8.
What specific vulnerability does REDHAT-BUG-887914 address?
REDHAT-BUG-887914 addresses the need to escape arbitrary symbols in the content of <matches> in custom action files.
Who discovered the issue in REDHAT-BUG-887914?
The discovery of the issue in REDHAT-BUG-887914 was credited to the NBS System security team.