| Summary: | net-analyzer/fail2ban: code exection via malicious whois responses (CVE-2021-32749) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | John Helmert III <ajak> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | IN_PROGRESS --- | ||
| Severity: | normal | CC: | eras, hlein, sam |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm | ||
| Whiteboard: | B2 [ebuild] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | 802867 | ||
| Bug Blocks: | |||
|
Description
John Helmert III
2021-07-16 23:30:07 UTC
Note, the fix is broken at least with mailx. I've filed a bug upstream: https://github.com/fail2ban/fail2ban/issues/3059 tl;dr their fix is not needed on systems where mail(1) comes from mailx, and in fact, breaks fail2ban on those systems. I kept an eye on the upstream bug Hank (CC'd) linked to and he ended up concluding this is a bug in GNU mailutils [0]. It's now been fixed [1] there, so we should try backport the patch if they're not going to make a release shortly. [0] https://savannah.gnu.org/bugs/index.php?60937 [1] https://git.savannah.gnu.org/cgit/mailutils.git/commit/?id=4befcfd015256c568121653038accbd84820198f (In reply to Sam James from comment #2) > I kept an eye on the upstream bug Hank (CC'd) linked to and he ended up > concluding this is a bug in GNU mailutils [0]. > > It's now been fixed [1] there, so we should try backport the patch if > they're not going to make a release shortly. > Pinged upstream: https://savannah.gnu.org/bugs/index.php?60937#comment2. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Since this problem is confined to an interaction with mailutils, would it be appropriate to update RDEPEND to !net-mail/mailutils ? Either for any version (since no fixed ones are available yet) or for <= the current release since we expect the next release to include the already-committed fix (and even an -rN bump of mailutils that cherry-picks that fix would be sufficient)? Huh, funny thing, fail2ban has no virtual/mailx dependency, and it doesn't seem that virtual is required by @system. So potentially one could have fail2ban with no mailer at all, and thus not be vulnerable because the relevant actions would not be functional. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4ba91eed15ea76165f60e3478cd4461ce3d0cd3d commit 4ba91eed15ea76165f60e3478cd4461ce3d0cd3d Author: Eray Aslan <eras@gentoo.org> AuthorDate: 2021-07-30 07:07:37 +0000 Commit: Eray Aslan <eras@gentoo.org> CommitDate: 2021-07-30 07:07:37 +0000 net-mail/mailutils: disable escapes in non-interactive mode unlike other mail(1) implementations, mailutils mail command allowed escape characters in non-interactive mode, resulting in CVE-2021-32749 in fail2ban package. backport fix for mailutils-3.12 Bug: https://bugs.gentoo.org/802513 Package-Manager: Portage-3.0.20, Repoman-3.0.3 Signed-off-by: Eray Aslan <eras@gentoo.org> .../files/mailutils-3.12-disable_escapes.patch | 24 ++++ net-mail/mailutils/mailutils-3.12-r3.ebuild | 144 +++++++++++++++++++++ 2 files changed, 168 insertions(+) Ping. Looks like this can be fixed in fail2ban too? |