Compare commits
3 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
78ef497cb1 | ||
|
|
f7c1ffcf71 | ||
|
|
59c95d6724 |
3 changed files with 218 additions and 2 deletions
155
410a6ce5c80dd981c22752da034f2529b5eee844.patch
Normal file
155
410a6ce5c80dd981c22752da034f2529b5eee844.patch
Normal file
|
|
@ -0,0 +1,155 @@
|
|||
From 410a6ce5c80dd981c22752da034f2529b5eee844 Mon Sep 17 00:00:00 2001
|
||||
From: sebres <serg.brester@sebres.de>
|
||||
Date: Mon, 21 Jun 2021 17:12:53 +0200
|
||||
Subject: [PATCH] fixed possible RCE vulnerability, unset escape variable
|
||||
(default tilde) stops consider "~" char after new-line as composing escape
|
||||
sequence
|
||||
|
||||
---
|
||||
config/action.d/complain.conf | 2 +-
|
||||
config/action.d/dshield.conf | 2 +-
|
||||
config/action.d/mail-buffered.conf | 8 ++++----
|
||||
config/action.d/mail-whois-lines.conf | 2 +-
|
||||
config/action.d/mail-whois.conf | 6 +++---
|
||||
config/action.d/mail.conf | 6 +++---
|
||||
6 files changed, 13 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/config/action.d/complain.conf b/config/action.d/complain.conf
|
||||
index 3a5f882c9f..4d73b05859 100644
|
||||
--- a/config/action.d/complain.conf
|
||||
+++ b/config/action.d/complain.conf
|
||||
@@ -102,7 +102,7 @@ logpath = /dev/null
|
||||
# Notes.: Your system mail command. Is passed 2 args: subject and recipient
|
||||
# Values: CMD
|
||||
#
|
||||
-mailcmd = mail -s
|
||||
+mailcmd = mail -E 'set escape' -s
|
||||
|
||||
# Option: mailargs
|
||||
# Notes.: Additional arguments to mail command. e.g. for standard Unix mail:
|
||||
diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf
|
||||
index c128bef348..3d5a7a53a9 100644
|
||||
--- a/config/action.d/dshield.conf
|
||||
+++ b/config/action.d/dshield.conf
|
||||
@@ -179,7 +179,7 @@ tcpflags =
|
||||
# Notes.: Your system mail command. Is passed 2 args: subject and recipient
|
||||
# Values: CMD
|
||||
#
|
||||
-mailcmd = mail -s
|
||||
+mailcmd = mail -E 'set escape' -s
|
||||
|
||||
# Option: mailargs
|
||||
# Notes.: Additional arguments to mail command. e.g. for standard Unix mail:
|
||||
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
|
||||
index 325f185b2f..79b841049c 100644
|
||||
--- a/config/action.d/mail-buffered.conf
|
||||
+++ b/config/action.d/mail-buffered.conf
|
||||
@@ -17,7 +17,7 @@ actionstart = printf %%b "Hi,\n
|
||||
The jail <name> has been started successfully.\n
|
||||
Output will be buffered until <lines> lines are available.\n
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
@@ -28,13 +28,13 @@ actionstop = if [ -f <tmpfile> ]; then
|
||||
These hosts have been banned by Fail2Ban.\n
|
||||
`cat <tmpfile>`
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary from <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary from <fq-hostname>" <dest>
|
||||
rm <tmpfile>
|
||||
fi
|
||||
printf %%b "Hi,\n
|
||||
The jail <name> has been stopped.\n
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
@@ -55,7 +55,7 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
|
||||
These hosts have been banned by Fail2Ban.\n
|
||||
`cat <tmpfile>`
|
||||
\nRegards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: Summary" <dest>
|
||||
rm <tmpfile>
|
||||
fi
|
||||
|
||||
diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf
|
||||
index 3a3e56b2c7..d2818cb9b9 100644
|
||||
--- a/config/action.d/mail-whois-lines.conf
|
||||
+++ b/config/action.d/mail-whois-lines.conf
|
||||
@@ -72,7 +72,7 @@ actionunban =
|
||||
# Notes.: Your system mail command. Is passed 2 args: subject and recipient
|
||||
# Values: CMD
|
||||
#
|
||||
-mailcmd = mail -s
|
||||
+mailcmd = mail -E 'set escape' -s
|
||||
|
||||
# Default name of the chain
|
||||
#
|
||||
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
|
||||
index 7fea34c40d..ab33b616dc 100644
|
||||
--- a/config/action.d/mail-whois.conf
|
||||
+++ b/config/action.d/mail-whois.conf
|
||||
@@ -20,7 +20,7 @@ norestored = 1
|
||||
actionstart = printf %%b "Hi,\n
|
||||
The jail <name> has been started successfully.\n
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
@@ -29,7 +29,7 @@ actionstart = printf %%b "Hi,\n
|
||||
actionstop = printf %%b "Hi,\n
|
||||
The jail <name> has been stopped.\n
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
@@ -49,7 +49,7 @@ actionban = printf %%b "Hi,\n
|
||||
Here is more information about <ip> :\n
|
||||
`%(_whois_command)s`\n
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
|
||||
index 5d8c0e154c..f4838ddcb6 100644
|
||||
--- a/config/action.d/mail.conf
|
||||
+++ b/config/action.d/mail.conf
|
||||
@@ -16,7 +16,7 @@ norestored = 1
|
||||
actionstart = printf %%b "Hi,\n
|
||||
The jail <name> has been started successfully.\n
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: started on <fq-hostname>" <dest>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
@@ -25,7 +25,7 @@ actionstart = printf %%b "Hi,\n
|
||||
actionstop = printf %%b "Hi,\n
|
||||
The jail <name> has been stopped.\n
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: stopped on <fq-hostname>" <dest>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
@@ -43,7 +43,7 @@ actionban = printf %%b "Hi,\n
|
||||
The IP <ip> has just been banned by Fail2Ban after
|
||||
<failures> attempts against <name>.\n
|
||||
Regards,\n
|
||||
- Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
|
||||
+ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] <name>: banned <ip> from <fq-hostname>" <dest>
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
48
f259dac74721c00f0184bf45277137771fc747fe.patch
Normal file
48
f259dac74721c00f0184bf45277137771fc747fe.patch
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
From 747d4683221b5584f9663695fb48145689b42ceb Mon Sep 17 00:00:00 2001
|
||||
From: sebres <info@sebres.de>
|
||||
Date: Mon, 4 Jan 2021 02:42:38 +0100
|
||||
Subject: [PATCH] fixes century selector of %ExY and %Exy in datepattern for
|
||||
tests, considering interval from 2005 (alternate now) to now; + better
|
||||
grouping algorithm for resulting century RE
|
||||
|
||||
---
|
||||
fail2ban/server/strptime.py | 24 ++++++++++++++++++++++--
|
||||
1 file changed, 22 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/fail2ban/server/strptime.py b/fail2ban/server/strptime.py
|
||||
index 1464a96d1f..39fc795865 100644
|
||||
--- a/fail2ban/server/strptime.py
|
||||
+++ b/fail2ban/server/strptime.py
|
||||
@@ -36,10 +36,30 @@ def _getYearCentRE(cent=(0,3), distance=3, now=(MyTime.now(), MyTime.alternateNo
|
||||
Thereby respect possible run in the test-cases (alternate date used there)
|
||||
"""
|
||||
cent = lambda year, f=cent[0], t=cent[1]: str(year)[f:t]
|
||||
+ def grp(exprset):
|
||||
+ c = None
|
||||
+ if len(exprset) > 1:
|
||||
+ for i in exprset:
|
||||
+ if c is None or i[0:-1] == c:
|
||||
+ c = i[0:-1]
|
||||
+ else:
|
||||
+ c = None
|
||||
+ break
|
||||
+ if not c:
|
||||
+ for i in exprset:
|
||||
+ if c is None or i[0] == c:
|
||||
+ c = i[0]
|
||||
+ else:
|
||||
+ c = None
|
||||
+ break
|
||||
+ if c:
|
||||
+ return "%s%s" % (c, grp([i[len(c):] for i in exprset]))
|
||||
+ return ("(?:%s)" % "|".join(exprset) if len(exprset[0]) > 1 else "[%s]" % "".join(exprset)) \
|
||||
+ if len(exprset) > 1 else "".join(exprset)
|
||||
exprset = set( cent(now[0].year + i) for i in (-1, distance) )
|
||||
if len(now) and now[1]:
|
||||
- exprset |= set( cent(now[1].year + i) for i in (-1, distance) )
|
||||
- return "(?:%s)" % "|".join(exprset) if len(exprset) > 1 else "".join(exprset)
|
||||
+ exprset |= set( cent(now[1].year + i) for i in xrange(-1, now[0].year-now[1].year+1, distance) )
|
||||
+ return grp(sorted(list(exprset)))
|
||||
|
||||
timeRE = TimeRE()
|
||||
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
Name: fail2ban
|
||||
Version: 0.11.2
|
||||
Release: 1%{?dist}
|
||||
Release: 3%{?dist}
|
||||
Summary: Daemon to ban hosts that cause multiple authentication errors
|
||||
|
||||
License: GPLv2+
|
||||
|
|
@ -15,6 +15,11 @@ Source4: Makefile
|
|||
# https://bugzilla.redhat.com/show_bug.cgi?id=1379141
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1573185
|
||||
Patch0: fail2ban-partof.patch
|
||||
# https://github.com/fail2ban/fail2ban/issues/2904#issuecomment-754042663
|
||||
Patch1: https://github.com/fail2ban/fail2ban/commit/f259dac74721c00f0184bf45277137771fc747fe.patch
|
||||
# CVE-2021-32749 https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm
|
||||
Patch3: https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f2529b5eee844.patch
|
||||
|
||||
|
||||
BuildArch: noarch
|
||||
|
||||
|
|
@ -278,7 +283,8 @@ install -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{
|
|||
|
||||
%check
|
||||
%if 0%{?rhel} && 0%{?rhel} < 8
|
||||
%python2 bin/fail2ban-testcases --verbosity=2 --no-network
|
||||
# set locale to a UTF8 version as workaround to https://github.com/fail2ban/fail2ban/issues/2936
|
||||
LC_ALL=en_US.UTF-8 %python2 bin/fail2ban-testcases --verbosity=2 --no-network
|
||||
%else
|
||||
%python3 bin/fail2ban-testcases --verbosity=2 --no-network
|
||||
%endif
|
||||
|
|
@ -389,6 +395,13 @@ fi
|
|||
|
||||
|
||||
%changelog
|
||||
* Wed Oct 13 2021 Richard Shaw <hobbes1069@gmail.com> - 0.11.2-3
|
||||
- Address CVE-2021-32749.
|
||||
|
||||
* Thu Oct 07 2021 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 0.11.2-2
|
||||
- Add upstream patch for issue #2904
|
||||
- Set locale to a UTF8 variant for tests
|
||||
|
||||
* Tue Nov 24 2020 Richard Shaw <hobbes1069@gmail.com> - 0.11.2-1
|
||||
- Update to 0.11.2.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue