Skip to content
OpenAdvisories
Medium USN-5232-1 1 CVE

fail2ban vulnerability

Published Sep 12, 2022 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Jakub Żoczek discovered that certain Fail2ban actions handled whois responses in
an insecure way. If Fail2ban was configured to use certain mail actions
like 'mail-whois' on a target system, a remote attacker who was able to control whois
responses to this target system could possibly execute arbitrary code.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS fail2ban 0.8.11-1ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS fail2ban 0.9.3-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS fail2ban 0.10.2-2ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS fail2ban 0.11.1-1ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 6.1
    CVE-2021-32749

    Possible RCE vulnerability in mailing action using mailutils (mail-whois)

    fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois.…

    fail2ban fail2ban fail2ban fail2ban Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2021-32749