Multiple vulnerabilities have been found in Fail2ban, the worst of which allows remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/fail2ban | * | < 0.8.12 | >= 0.8.12 |
Fail2ban is a tool for parsing log files and banning IP addresses which show suspicious behavior.
Multiple vulnerabilities have been discovered in Fail2ban. Please review the CVE identifiers referenced below for details.
A remote attacker could send a crafted URL to a web site which, when parsed by Fail2ban, would deny a specific IP address. Also, errors in regular expressions within certain filters can cause arbitrary IP addresses to be banned. Furthermore, a local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application.
There is no known workaround at this time.
All Fail2ban users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/fail2ban-0.8.12
Fail2ban is vulnerable to a Denial of Service attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/fail2ban | * | < 0.8.0-r1 | >= 0.8.0-r1 |
Fail2ban is a tool for parsing log files and banning IP addresses which make too many password failures.
A vulnerability has been discovered in Fail2ban when parsing log files.
A remote attacker could send specially crafted SSH login banners to the vulnerable host, which would prevent any ssh connection to the host and result in a Denial of Service.
There is no known workaround at this time.
All Fail2ban users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/fail2ban-0.8.0-r1"
A flaw in Fail2ban may allow remote attackers to deny access to arbitrary hosts.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/fail2ban | * | < 0.6.2 | >= 0.6.2 |
Fail2ban monitors log files for failed authentication attempts and can block hosts responsible for repeated attacks.
A flaw in the method used to parse log entries allows remote, unauthenticated attackers to forge authentication attempts from other hosts.
A remote attacker can add arbitrary hosts to the block list, denying legitimate users access to a resource.
There is no known workaround at this time.
All Fail2ban users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/fail2ban-0.6.2"