CVE-2012-5642 server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified...
HighCVSS 7.5
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/fail2ban(Debian:12) | < 0.8.6-3wheezy1 | 0.8.6-3wheezy1 |
| debian/fail2ban(Debian:13) | < 0.8.6-3wheezy1 | 0.8.6-3wheezy1 |
| debian/fail2ban(Debian:14) | < 0.8.6-3wheezy1 | 0.8.6-3wheezy1 |
| fail2ban | <= 0.8.7.1 | No fix listed |
| fail2ban | = 0.1.0 | No fix listed |
| fail2ban | = 0.1.1 | No fix listed |
| fail2ban | = 0.1.2 | No fix listed |
| fail2ban | = 0.3.0 | No fix listed |
| fail2ban | = 0.3.1 | No fix listed |
| fail2ban | = 0.4.0 | No fix listed |
| fail2ban | = 0.4.1 | No fix listed |
| fail2ban | = 0.5.0 | No fix listed |
| fail2ban | = 0.5.1 | No fix listed |
| fail2ban | = 0.5.2 | No fix listed |
| fail2ban | = 0.5.3 | No fix listed |
| fail2ban | = 0.5.4 | No fix listed |
| fail2ban | = 0.5.5 | No fix listed |
| fail2ban | = 0.6.0 | No fix listed |
| fail2ban | = 0.6.1 | No fix listed |
| fail2ban | = 0.7.0 | No fix listed |
| fail2ban | = 0.7.1 | No fix listed |
| fail2ban | = 0.7.2 | No fix listed |
| fail2ban | = 0.7.3 | No fix listed |
| fail2ban | = 0.7.4 | No fix listed |
| fail2ban | = 0.7.5 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| fail2ban | = 0.7.6 | No fix listed |
| fail2ban | = 0.7.7 | No fix listed |
| fail2ban | = 0.7.8 | No fix listed |
| fail2ban | = 0.7.9 | No fix listed |
| fail2ban | = 0.8.0 | No fix listed |
| fail2ban | = 0.8.1 | No fix listed |
| fail2ban | = 0.8.2 | No fix listed |
| fail2ban | = 0.8.3 | No fix listed |
| fail2ban | = 0.8.4 | No fix listed |
| fail2ban | = 0.8.5 | No fix listed |
| fail2ban | = 0.8.6 | No fix listed |
| fail2ban | = 0.8.7 | No fix listed |
References
- Debian Security Tracker CVE-2012-5642 vendor-advisory
- openSUSE-SU-2013:0566 vendor-advisory
- openSUSE-SU-2013:0567 vendor-advisory
- [fail2ban-users] 20121206 0.8.8 release mailing-list
- MDVSA-2013:078 vendor-advisory
- [oss-security] 20121217 Re: CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on <matches> content mailing-list
- bugs.gentoo.org
- bugzilla.redhat.com
- github.com patch vendor-advisory
- raw.github.com
- bugs.debian.org issue-tracking