oss-security - CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on <matches> content

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121217154122.GA24980@redhat.com>
Date: Mon, 17 Dec 2012 08:41:22 -0700
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on
 <matches> content

Could a CVE be assigned to this issue please?

The release notes for fail2ban 0.8.8 indicate:

    * [83109bc] IMPORTANT: escape the content of <matches> (if used in
      custom action files) since its value could contain arbitrary
      symbols.  Thanks for discovery go to the NBS System security
      team

This could cause issues on the system running fail2ban as it scans log
files, depending on what content is matched.  There isn't much more
detail about this issue than what is described above, so I think it may
largely depend on the type of regexp used (what it matches) and the
contents of the log file being scanned (whether or not an attacher could
insert something that could be used in a malicious way).

References:

https://raw.github.com/fail2ban/fail2ban/master/ChangeLog
http://sourceforge.net/mailarchive/message.php?msg_id=30193056
https://github.com/fail2ban/fail2ban/commit/83109bc
https://bugzilla.redhat.com/show_bug.cgi?id=887914
https://bugs.gentoo.org/show_bug.cgi?id=447572

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.