CERBERUS/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-10-21 11:31:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

filter.d/common.conf - improved RE for logtype rfc5424 (better compliant to RFC 5424);
Some checks failed
Codespell / Check for spelling errors (push) Has been cancelled
Details
CI / build (3.10) (push) Has been cancelled
Details
CI / build (3.11) (push) Has been cancelled
Details
CI / build (3.12) (push) Has been cancelled
Details
CI / build (3.13) (push) Has been cancelled
Details
CI / build (3.14) (push) Has been cancelled
Details
CI / build (3.15.0-rc.2) (push) Has been cancelled
Details
CI / build (3.8) (push) Has been cancelled
Details
CI / build (3.9) (push) Has been cancelled
Details
CI / build (pypy3.11) (push) Has been cancelled
Details

Browse source 
- fixed prefix-line for malformed RFC 5424, vulnerable against ReDoS (catastrophic backtracking) by non-conform logger or artificial "injection" attempt on STRUCTURED-DATA, unescaped new-line in PARAM-VALUE, etc (GHSA-c2mg-2r7g-c3wp)
This commit is contained in:
sebres 2026-09-28 22:20:27 +02:00
parent 7212404e8f
commit 2cc5bed3dc
2 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
config/filter.d/common.conf
View file

@ -82,8 +82,7 @@ datepattern = %(lt_short/datepattern)s
[lt_rfc5424]
# RFC 5424 log-format, see gh-2309:
#__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ \S+\s+
__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:[^\[\]\s]+|(?:\[(?:[^\]"]*|"[^"]*")*\])+)\s+
__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:-|(?:\[(?:[^\]"]|"(?:[^"\\]|\\.)*")*\])+)\s+
datepattern = ^<\d+>\d+\s+{DATE}
# Author: Yaroslav Halchenko, Sergey G. Brester (aka sebres)

7
fail2ban/tests/files/logs/sshd
View file

@ -414,4 +414,11 @@ Nov 26 16:47:51 srv sshd[19320]: Disconnected from authenticating user root 192.
# failJSON: { "time": "2019-07-08T23:40:17", "match": true , "host": "192.0.2.2", "desc": "RFC 5424 format with extra data and brackets in value (gh-2309)" }
<38>1 2019-07-08T17:40:17.954167-04:00 hostname.example.com sshd 55555 - [timeQuality tzKnown="1" isSynced="0"][xxx@123 test="[brackets]"] Failed unknown for invalid user redmond from 192.0.2.2 port 55555 ssh2
# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA field (GHSA-c2mg-2r7g-c3wp)" }
<38>1 2019-07-08T17:40:17.954169-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA 2nd field (GHSA-c2mg-2r7g-c3wp)" }
<38>1 2019-07-08T17:40:17.954170-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA][BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA, unescaped new-line in PARAM-VALUE (GHSA-c2mg-2r7g-c3wp)" }
<38>1 2019-07-08T17:40:17.954171-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAA XXX="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
# addFILE: "sshd-journal"