The package fail2ban is vulnerable to arbitrary command execution via CVE-2021-32749.

[Stephen Murcott]

The package fail2ban is vulnerable to arbitrary command execution via CVE-2021-32749.

https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm
https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f2529b5eee844

https://www.cybersecurity-help.cz/vdb/SB2021072310

RCE please can this be updated across the Ubuntu ecosystem?

[Alex Murray (alexmurray)]

This RCE is only possible if an attacker can control the results from the whois server - which is not very likely IMO. Thus I don't think this is a high priority issue. Also since the fail2ban package is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Stephen Murcott (scmurcott)]

Thank you for taking the time to respond. I will try to get hold of the maintainers.

I've already mitigated on my systems as a precautionary measure.

I can see that the Debian team is already on this:
https://security-tracker.debian.org/tracker/CVE-2021-32749

I am sure the Ubuntu package maintainers are aware.

https://packages.ubuntu.com/focal/fail2ban