GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2012-5642

Vulnerability from fkie_nvd - Published: 2012-12-31 11:50 - Updated: 2026-06-16 23:47
Severity
Summary
server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content.
References
secalert@redhat.comhttp://lists.opensuse.org/opensuse-updates/2013-04/msg00001.html
secalert@redhat.comhttp://lists.opensuse.org/opensuse-updates/2013-04/msg00002.html
secalert@redhat.comhttp://sourceforge.net/mailarchive/message.php?msg_id=30193056
secalert@redhat.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:078
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/12/17/2
secalert@redhat.comhttps://bugs.gentoo.org/show_bug.cgi?id=447572
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=887914
secalert@redhat.comhttps://github.com/fail2ban/fail2ban/commit/83109bcPatch, Vendor Advisory
secalert@redhat.comhttps://raw.github.com/fail2ban/fail2ban/master/ChangeLog
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2013-04/msg00001.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2013-04/msg00002.html
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/mailarchive/message.php?msg_id=30193056
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2013:078
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/12/17/2
af854a3a-2127-422b-91ae-364da2661108https://bugs.gentoo.org/show_bug.cgi?id=447572
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=887914
af854a3a-2127-422b-91ae-364da2661108https://github.com/fail2ban/fail2ban/commit/83109bcPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://raw.github.com/fail2ban/fail2ban/master/ChangeLog
Impacted products
Vendor Product Version
fail2ban fail2ban *
fail2ban fail2ban 0.1.0
fail2ban fail2ban 0.1.1
fail2ban fail2ban 0.1.2
fail2ban fail2ban 0.3.0
fail2ban fail2ban 0.3.1
fail2ban fail2ban 0.4.0
fail2ban fail2ban 0.4.1
fail2ban fail2ban 0.5.0
fail2ban fail2ban 0.5.1
fail2ban fail2ban 0.5.2
fail2ban fail2ban 0.5.3
fail2ban fail2ban 0.5.4
fail2ban fail2ban 0.5.5
fail2ban fail2ban 0.6.0
fail2ban fail2ban 0.6.1
fail2ban fail2ban 0.7.0
fail2ban fail2ban 0.7.1
fail2ban fail2ban 0.7.2
fail2ban fail2ban 0.7.3
fail2ban fail2ban 0.7.4
fail2ban fail2ban 0.7.5
fail2ban fail2ban 0.7.6
fail2ban fail2ban 0.7.7
fail2ban fail2ban 0.7.8
fail2ban fail2ban 0.7.9
fail2ban fail2ban 0.8.0
fail2ban fail2ban 0.8.1
fail2ban fail2ban 0.8.2
fail2ban fail2ban 0.8.3
fail2ban fail2ban 0.8.4
fail2ban fail2ban 0.8.5
fail2ban fail2ban 0.8.6
fail2ban fail2ban 0.8.7
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "43813F24-CB93-46D7-8F91-6D436FB04564",
              "versionEndIncluding": "0.8.7.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7750E527-5A05-4716-BF4A-B40EA9E34394",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA9C7EF4-DA9B-4ADF-A044-2AC8A2FC270F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FCFD263-E347-43DD-80A6-D222FCEF23D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "64A0FEBA-647F-41F4-8590-7E8C7A49A36D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "40BBF7B9-57DB-4479-B2C3-8EB466185E94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7847766-CF03-4BF1-BE69-09C50AEC3DFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E004A754-3CCB-409D-B13A-DF735ED63971",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADF9F5C0-7E85-40AC-A7AA-7442749E48D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2331299E-1834-4853-B38B-9E24A364EC62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA9B27B6-418F-4101-A4A1-6E887BF0BB39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B6C2141-12A6-428A-9223-A0CA743BC020",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0468228-10A0-4F72-BE85-D50ED3AA10B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B73E5BBF-3755-4DC8-840F-2466BB2B280D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "880958EA-3BE3-4F16-B323-3CA878BEB3A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB79FF61-80D6-4AB8-BC6F-6924AF9A0969",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "66BAD83B-AACD-4BCE-8900-8558C6F82D7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "719BA249-7B47-488E-86BA-C08286FF8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A88DA08A-A1C6-4BC1-9BC1-BE823207BFA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD346590-84C5-473E-9672-2E920C71B7FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F288E708-A212-4007-A32A-3608C56C5F7B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF7EEF2A-DC72-4F51-B168-237EFA637988",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D366BB8-A4FB-44CC-94BE-3C3BA3861C91",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "114BC59D-4035-4BC6-B697-9D10415CBDD9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB94274B-C1AF-4F87-B244-7BA4526F5D1E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.7.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "98844A94-ABB6-41B4-A5B0-3101F54A3652",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F522ECF-7F87-4A25-9CF3-0BCD99B4CAEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFEB99EB-DA51-48BB-96BD-4D47D8839C75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E29B3199-71BB-4EED-9D91-B6F941AD7BAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE8CF239-5E91-4708-B594-FA825C69DFE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DB5D2A5-78E3-49C0-9A8D-397B21E03E26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.8.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFFCA848-72E8-4E33-A636-3D9009AAF870",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.8.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "A97A9988-C973-4ACF-BD37-570004F1AD38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fail2ban:fail2ban:0.8.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF73708F-4237-47BA-83B8-5999EED0EC28",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content."
    },
    {
      "lang": "es",
      "value": "server/action.py en Fail2ban antes de v0.8.8 no controla correctamente el contenido de las etiquetas \u0027matches\u0027, lo que podr\u00eda permitir a atacantes remotos provocar conductas inseguras en un archivo de acci\u00f3n personalizado a trav\u00e9s de s\u00edmbolos no especificados en este contenido.\r\n"
    }
  ],
  "id": "CVE-2012-5642",
  "lastModified": "2026-06-16T23:47:08.527",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-12-31T11:50:27.890",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00001.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00002.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://sourceforge.net/mailarchive/message.php?msg_id=30193056"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:078"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/12/17/2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugs.gentoo.org/show_bug.cgi?id=447572"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=887914"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/fail2ban/fail2ban/commit/83109bc"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://raw.github.com/fail2ban/fail2ban/master/ChangeLog"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/mailarchive/message.php?msg_id=30193056"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:078"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/12/17/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugs.gentoo.org/show_bug.cgi?id=447572"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=887914"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/fail2ban/fail2ban/commit/83109bc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://raw.github.com/fail2ban/fail2ban/master/ChangeLog"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.