Source: fail2ban Version: 1.1.1-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for fail2ban. CVE-2026-109786[0]: | In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter | (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the | host address. Because OpenSSH logs the offered username verbatim, a | remote unauthenticated attacker can use a username such as "x | VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login | attempts with an arbitrary source IP address and ban it (e.g., to | block logins from a legitimate user). The default filter mode is | affected. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-109786 https://www.cve.org/CVERecord?id=CVE-2026-109786 [1] https://github.com/fail2ban/fail2ban/commit/ddd879d22664904ace24e1255ac6571808c58187 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
