Description
fail2ban 0.8 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a client protocol version identification containing an IP address string, a different vector than CVE-2006-6302.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | fail2ban | 0.8.0-4 | — |
| Debian 13 | fail2ban | 0.8.0-4 | — |
| Debian 12 | fail2ban | 0.8.0-4 | — |
| Debian 4.0 | fail2ban | 0.7.5-2etch1 | DSA-1456-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Fail2ban 0.8 - Remote Denial of Service EDB-30430 · dos · Jul 28, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-1456-1 fail2ban Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-1456 vendor-advisory
- 23237 third-party-advisory
- 42484 vdb-entry
- 25117 vdb-entry
- 28374 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=181214
- GLSA-200707-13 vendor-advisory
- http://www.ossec.net/en/attacking-loganalysis.html