Refine your search
2 vulnerabilities found for by fail2ban
CVE-2026-109786 (GCVE-0-2026-109786)
Vulnerability from cvelistv5
Published
2026-10-13 02:40
Modified
2026-10-15 15:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-117 - Improper Output Neutralization for Logs
Summary
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109786",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:03:56.691809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:04:19.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"sshd filter"
],
"platforms": [
"Linux",
"Unix"
],
"product": "fail2ban",
"programFiles": [
"config/filter.d/sshd.conf"
],
"repo": "https://github.com/fail2ban/fail2ban",
"vendor": "fail2ban",
"versions": [
{
"lessThanOrEqual": "1.1.1",
"status": "affected",
"version": "0.10.5",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The sshd jail is enabled with the stock filter.d/sshd.conf (any mode: normal, the default, extra, or aggressive). Before 1.1.1 the filter only matches log lines from a process named sshd (OpenSSH before 10, or systems that log as sshd); 1.1.1 also matches OpenSSH 10\u0027s sshd-session."
}
],
"value": "The sshd jail is enabled with the stock filter.d/sshd.conf (any mode: normal, the default, extra, or aggressive). Before 1.1.1 the filter only matches log lines from a process named sshd (OpenSSH before 10, or systems that log as sshd); 1.1.1 also matches OpenSSH 10\u0027s sshd-session."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fail2ban:fail2ban:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.1.1",
"versionStartIncluding": "0.10.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an \"on \u003ctoken\u003e\" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as \"x VICTIM-SOURCE-IP-ADDRESS on\" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117 Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T02:40:13.899Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/fail2ban/fail2ban/commit/ddd879d22664904ace24e1255ac6571808c58187"
},
{
"tags": [
"related"
],
"url": "https://coredump.ws/repos/mail-hardening.git/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apply upstream commit ddd879d22664904ace24e1255ac6571808c58187, or upgrade to the first fail2ban release after 1.1.1 that contains it."
}
],
"value": "Apply upstream commit ddd879d22664904ace24e1255ac6571808c58187, or upgrade to the first fail2ban release after 1.1.1 that contains it."
}
],
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Override __on_port_opt and __suff in a local filter.d/sshd.local so that only an optional \"port N\" may follow the host address, as in the upstream fix: __on_port_opt = (?: port \\d+)? and __suff = %(__on_port_opt)s(?: \\[preauth\\])?\\s*. Add the administrator\u0027s own addresses to ignoreip."
}
],
"value": "Override __on_port_opt and __suff in a local filter.d/sshd.local so that only an optional \"port N\" may follow the host address, as in the upstream fix: __on_port_opt = (?: port \\d+)? and __suff = %(__on_port_opt)s(?: \\[preauth\\])?\\s*. Add the administrator\u0027s own addresses to ignoreip."
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-109786",
"datePublished": "2026-10-13T02:40:13.899Z",
"dateReserved": "2026-10-13T02:40:12.792Z",
"dateUpdated": "2026-10-15T15:04:19.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-32749 (GCVE-0-2021-32749)
Vulnerability from cvelistv5
Published
2021-07-16 00:00
Modified
2024-08-03 23:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary
fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command `mail` from mailutils package used in mail actions like `mail-whois` can execute command if unescaped sequences (`\n~`) are available in "foreign" input (for instance in whois output). To exploit the vulnerability, an attacker would need to insert malicious characters into the response sent by the whois server, either via a MITM attack or by taking over a whois server. The issue is patched in versions 0.10.7 and 0.11.3. As a workaround, one may avoid the usage of action `mail-whois` or patch the vulnerability manually.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:54.871Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/fail2ban/fail2ban/commit/2ed414ed09b3bb4c478abc9366a1ff22024a33c9"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f2529b5eee844"
},
{
"name": "FEDORA-2021-0ab8f6a19a",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WHJK2X2MR2WDYZMCW7COZXJDUSDYMY6/"
},
{
"name": "FEDORA-2021-a18b79d182",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRYQ77MTX5WSV33VCJLK4KBKR55QZ7ZA/"
},
{
"name": "GLSA-202310-13",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202310-13"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "fail2ban",
"vendor": "fail2ban",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.9.7"
},
{
"status": "affected",
"version": "\u003e= 0.10.0, \u003c= 0.10.6"
},
{
"status": "affected",
"version": "\u003e= 0.11.0, \u003c= 0.11.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command `mail` from mailutils package used in mail actions like `mail-whois` can execute command if unescaped sequences (`\\n~`) are available in \"foreign\" input (for instance in whois output). To exploit the vulnerability, an attacker would need to insert malicious characters into the response sent by the whois server, either via a MITM attack or by taking over a whois server. The issue is patched in versions 0.10.7 and 0.11.3. As a workaround, one may avoid the usage of action `mail-whois` or patch the vulnerability manually."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-19T07:06:11.556Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm"
},
{
"url": "https://github.com/fail2ban/fail2ban/commit/2ed414ed09b3bb4c478abc9366a1ff22024a33c9"
},
{
"url": "https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f2529b5eee844"
},
{
"name": "FEDORA-2021-0ab8f6a19a",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WHJK2X2MR2WDYZMCW7COZXJDUSDYMY6/"
},
{
"name": "FEDORA-2021-a18b79d182",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRYQ77MTX5WSV33VCJLK4KBKR55QZ7ZA/"
},
{
"name": "GLSA-202310-13",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202310-13"
}
],
"source": {
"advisory": "GHSA-m985-3f3v-cwmm",
"discovery": "UNKNOWN"
},
"title": "Possible RCE vulnerability in mailing action using mailutils (mail-whois)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-32749",
"datePublished": "2021-07-16T00:00:00.000Z",
"dateReserved": "2021-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:33:54.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}