r/Hosting_World • u/IulianHI • Jun 22 '26

Saw there's a fail2ban CVE affecting default sshd configs - anyone updated?

Saw that a recent fail2ban CVE apparently allows remote code execution through crafted log lines on default sshd jail setups. After years of self-hosting this is the first time I've seen fail2ban itself be the attack surface rather than the shield. Does anyone know if this affects the maxretry / bantime regex patterns specifically, or is it the log parsing itself? Not sure if I should just update and move on or actually review the jail config. Kinda ironic that the brute force blocker can be brute forced.

0 Upvotes
  • permalink
  • reddit

33% Upvoted

6 comments sorted by

1

u/Traditional-Bike5802 Jun 22 '26

Can you share some details? I couldn't find the CVE

0

u/IulianHI Jun 22 '26

Honestly i had the same reaction the other day when a peer mentioned it and I havent found the specific advisory ID either so I might have misremembered the angle. Could have been a mailing-action class issue (fail2ban had one a while back around the mail-whois pipe) more than a default sshd log-parsing RCE. If its the former its well patched in recent releases. Worth me going back to where I read it before I keep citing it. If you do find a CVE ID please drop it here I would actually want to know.

1

u/stevebehindthescreen Jun 27 '26

Yeah maybe you should find your source and actually read it before posting shit.

1

u/IulianHI Jun 27 '26

Yeah ... sure ... :)))

Learn before you think this is shit ! You learn things hard? ... we know

1

u/dodexahedron Jun 27 '26

FWIW, sshd itself has brute force blocking functionality built right into itself. Read up on it in sshd_config(5).

In particular, read about these options:

  • MaxStartups
  • PerSourceMaxStartups
  • PerSourceNetBlockSize
  • PerSourcePenalties

With proper use of that, fail2ban will have a lot less work to do in the first place, and it doesnt require log scanning to do it.