oss-sec mailing list archives
CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on <matches> content
From: Vincent Danen <vdanen () redhat com>
Date: Mon, 17 Dec 2012 08:41:22 -0700
Could a CVE be assigned to this issue please? The release notes for fail2ban 0.8.8 indicate: * [83109bc] IMPORTANT: escape the content of <matches> (if used in custom action files) since its value could contain arbitrary symbols. Thanks for discovery go to the NBS System security team This could cause issues on the system running fail2ban as it scans log files, depending on what content is matched. There isn't much more detail about this issue than what is described above, so I think it may largely depend on the type of regexp used (what it matches) and the contents of the log file being scanned (whether or not an attacher could insert something that could be used in a malicious way). References: https://raw.github.com/fail2ban/fail2ban/master/ChangeLog http://sourceforge.net/mailarchive/message.php?msg_id=30193056 https://github.com/fail2ban/fail2ban/commit/83109bc https://bugzilla.redhat.com/show_bug.cgi?id=887914 https://bugs.gentoo.org/show_bug.cgi?id=447572 --Vincent Danen / Red Hat Security Response Team
Current thread:
- CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on <matches> content Vincent Danen (Dec 17)
- Re: CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on <matches> content Kurt Seifried (Dec 17)