From 861f18c31d7207164c7670673ac249a71997ce4a4febab8f6c72a4ef3574f614 Mon Sep 17 00:00:00 2001 From: Johannes Weberhofer Date: Tue, 24 Aug 2021 14:14:57 +0000 Subject: [PATCH] Accepting request 914045 from home:weberho:branches:security - Added fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch to fix CVE-2021-32749 - bnc#1188610 prevent a command injection via mail command - note bnc#1180738 in changelog OBS-URL: https://build.opensuse.org/request/show/914045 OBS-URL: https://build.opensuse.org/package/show/security/fail2ban?expand=0&rev=106 --- ....2-upstream-patch-for-CVE-2021-32749.patch | 155 ++++++++++++++++++ fail2ban.changes | 8 +- fail2ban.spec | 6 +- 3 files changed, 167 insertions(+), 2 deletions(-) create mode 100644 fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch diff --git a/fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch b/fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch new file mode 100644 index 0000000..45604b0 --- /dev/null +++ b/fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch @@ -0,0 +1,155 @@ +From 410a6ce5c80dd981c22752da034f2529b5eee844 Mon Sep 17 00:00:00 2001 +From: sebres +Date: Mon, 21 Jun 2021 17:12:53 +0200 +Subject: [PATCH] fixed possible RCE vulnerability, unset escape variable + (default tilde) stops consider "~" char after new-line as composing escape + sequence + +--- + config/action.d/complain.conf | 2 +- + config/action.d/dshield.conf | 2 +- + config/action.d/mail-buffered.conf | 8 ++++---- + config/action.d/mail-whois-lines.conf | 2 +- + config/action.d/mail-whois.conf | 6 +++--- + config/action.d/mail.conf | 6 +++--- + 6 files changed, 13 insertions(+), 13 deletions(-) + +diff --git a/config/action.d/complain.conf b/config/action.d/complain.conf +index 3a5f882c9f..4d73b05859 100644 +--- a/config/action.d/complain.conf ++++ b/config/action.d/complain.conf +@@ -102,7 +102,7 @@ logpath = /dev/null + # Notes.: Your system mail command. Is passed 2 args: subject and recipient + # Values: CMD + # +-mailcmd = mail -s ++mailcmd = mail -E 'set escape' -s + + # Option: mailargs + # Notes.: Additional arguments to mail command. e.g. for standard Unix mail: +diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf +index c128bef348..3d5a7a53a9 100644 +--- a/config/action.d/dshield.conf ++++ b/config/action.d/dshield.conf +@@ -179,7 +179,7 @@ tcpflags = + # Notes.: Your system mail command. Is passed 2 args: subject and recipient + # Values: CMD + # +-mailcmd = mail -s ++mailcmd = mail -E 'set escape' -s + + # Option: mailargs + # Notes.: Additional arguments to mail command. e.g. for standard Unix mail: +diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf +index 325f185b2f..79b841049c 100644 +--- a/config/action.d/mail-buffered.conf ++++ b/config/action.d/mail-buffered.conf +@@ -17,7 +17,7 @@ actionstart = printf %%b "Hi,\n + The jail has been started successfully.\n + Output will be buffered until lines are available.\n + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : started on " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : started on " + + # Option: actionstop + # Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +@@ -28,13 +28,13 @@ actionstop = if [ -f ]; then + These hosts have been banned by Fail2Ban.\n + `cat ` + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : Summary from " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : Summary from " + rm + fi + printf %%b "Hi,\n + The jail has been stopped.\n + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : stopped on " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : stopped on " + + # Option: actioncheck + # Notes.: command executed once before each actionban command +@@ -55,7 +55,7 @@ actionban = printf %%b "`date`: ( failures)\n" >> + These hosts have been banned by Fail2Ban.\n + `cat ` + \nRegards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : Summary" ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : Summary" + rm + fi + +diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf +index 3a3e56b2c7..d2818cb9b9 100644 +--- a/config/action.d/mail-whois-lines.conf ++++ b/config/action.d/mail-whois-lines.conf +@@ -72,7 +72,7 @@ actionunban = + # Notes.: Your system mail command. Is passed 2 args: subject and recipient + # Values: CMD + # +-mailcmd = mail -s ++mailcmd = mail -E 'set escape' -s + + # Default name of the chain + # +diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf +index 7fea34c40d..ab33b616dc 100644 +--- a/config/action.d/mail-whois.conf ++++ b/config/action.d/mail-whois.conf +@@ -20,7 +20,7 @@ norestored = 1 + actionstart = printf %%b "Hi,\n + The jail has been started successfully.\n + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : started on " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : started on " + + # Option: actionstop + # Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +@@ -29,7 +29,7 @@ actionstart = printf %%b "Hi,\n + actionstop = printf %%b "Hi,\n + The jail has been stopped.\n + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : stopped on " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : stopped on " + + # Option: actioncheck + # Notes.: command executed once before each actionban command +@@ -49,7 +49,7 @@ actionban = printf %%b "Hi,\n + Here is more information about :\n + `%(_whois_command)s`\n + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : banned from " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : banned from " + + # Option: actionunban + # Notes.: command executed when unbanning an IP. Take care that the +diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf +index 5d8c0e154c..f4838ddcb6 100644 +--- a/config/action.d/mail.conf ++++ b/config/action.d/mail.conf +@@ -16,7 +16,7 @@ norestored = 1 + actionstart = printf %%b "Hi,\n + The jail has been started successfully.\n + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : started on " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : started on " + + # Option: actionstop + # Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +@@ -25,7 +25,7 @@ actionstart = printf %%b "Hi,\n + actionstop = printf %%b "Hi,\n + The jail has been stopped.\n + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : stopped on " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : stopped on " + + # Option: actioncheck + # Notes.: command executed once before each actionban command +@@ -43,7 +43,7 @@ actionban = printf %%b "Hi,\n + The IP has just been banned by Fail2Ban after + attempts against .\n + Regards,\n +- Fail2Ban"|mail -s "[Fail2Ban] : banned from " ++ Fail2Ban"|mail -E 'set escape' -s "[Fail2Ban] : banned from " + + # Option: actionunban + # Notes.: command executed when unbanning an IP. Take care that the diff --git a/fail2ban.changes b/fail2ban.changes index 20b359e..edd0281 100644 --- a/fail2ban.changes +++ b/fail2ban.changes @@ -1,7 +1,13 @@ +------------------------------------------------------------------- +Tue Aug 24 13:40:32 UTC 2021 - Johannes Weberhofer + +- Added fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch + to fixs CVE-2021-32749 - bnc#1188610 to prevent a command injection via mail comand + ------------------------------------------------------------------- Sat Dec 5 17:25:17 UTC 2020 - Johannes Weberhofer -- Integrate change to resolve bnc#1146856 +- Integrate change to resolve bnc#1146856 and bnc#1180738 ------------------------------------------------------------------- Sun Nov 29 11:23:09 UTC 2020 - Johannes Weberhofer diff --git a/fail2ban.spec b/fail2ban.spec index 32d31ab..9932745 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,7 +1,7 @@ # # spec file for package fail2ban # -# Copyright (c) 2020 SUSE LLC +# Copyright (c) 2021 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -49,6 +49,9 @@ Patch200: %{name}-disable-iptables-w-option.patch Patch201: %{name}-0.10.4-env-script-interpreter.patch # PATCH-FEATURE-OPENSUSE fail2ban-opensuse-service-sfw.patch jweberhofer@weberhofer.at -- start after SuSEfirewall2 only for older distributions Patch300: fail2ban-opensuse-service-sfw.patch +# PATCH-FIX-UPSTREAM fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch jweberhofer@weberhofer.at -- fixes CVE-2021-32749 +Patch400: fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch + BuildRequires: fdupes BuildRequires: logrotate BuildRequires: python3-tools @@ -133,6 +136,7 @@ sed -i -e 's/^before = paths-.*/before = paths-opensuse.conf/' config/jail.conf %if !0%{?suse_version} > 1500 %patch300 -p1 %endif +%patch400 -p1 rm config/paths-arch.conf \ config/paths-debian.conf \