Vulnerability Description
fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command `mail` from mailutils package used in mail actions like `mail-whois` can execute command if unescaped sequences (`\n~`) are available in "foreign" input (for instance in whois output). To exploit the vulnerability, an attacker would need to insert malicious characters into the response sent by the whois server, either via a MITM attack or by taking over a whois server. The issue is patched in versions 0.10.7 and 0.11.3. As a workaround, one may avoid the usage of action `mail-whois` or patch the vulnerability manually.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fail2Ban | Fail2Ban | <= 0.9.7 |
| Fedoraproject | Fedora | 34 |
Related Weaknesses (CWE)
References
- https://github.com/fail2ban/fail2ban/commit/2ed414ed09b3bb4c478abc9366a1ff22024aPatchThird Party Advisory
- https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f2529b5eePatchThird Party Advisory
- https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmmExploitPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202310-13
- https://github.com/fail2ban/fail2ban/commit/2ed414ed09b3bb4c478abc9366a1ff22024aPatchThird Party Advisory
- https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f2529b5eePatchThird Party Advisory
- https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmmExploitPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202310-13
FAQ
What is CVE-2021-32749?
CVE-2021-32749 is a vulnerability with a CVSS score of 6.1 (MEDIUM). fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possi...
How severe is CVE-2021-32749?
CVE-2021-32749 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-32749?
Check the references section above for vendor advisories and patch information. Affected products include: Fail2Ban Fail2Ban, Fedoraproject Fedora.