From 2cc5bed3dc066a3d20ea00da4d4703746bd1594d Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 28 Sep 2026 22:20:27 +0200 Subject: [PATCH] `filter.d/common.conf` - improved RE for logtype `rfc5424` (better compliant to RFC 5424); - fixed prefix-line for malformed RFC 5424, vulnerable against ReDoS (catastrophic backtracking) by non-conform logger or artificial "injection" attempt on STRUCTURED-DATA, unescaped new-line in PARAM-VALUE, etc (GHSA-c2mg-2r7g-c3wp) --- config/filter.d/common.conf | 3 +-- fail2ban/tests/files/logs/sshd | 7 +++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf index e6b3c641..566883b2 100644 --- a/config/filter.d/common.conf +++ b/config/filter.d/common.conf @@ -82,8 +82,7 @@ datepattern = %(lt_short/datepattern)s [lt_rfc5424] # RFC 5424 log-format, see gh-2309: -#__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ \S+\s+ -__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:[^\[\]\s]+|(?:\[(?:[^\]"]*|"[^"]*")*\])+)\s+ +__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:-|(?:\[(?:[^\]"]|"(?:[^"\\]|\\.)*")*\])+)\s+ datepattern = ^<\d+>\d+\s+{DATE} # Author: Yaroslav Halchenko, Sergey G. Brester (aka sebres) diff --git a/fail2ban/tests/files/logs/sshd b/fail2ban/tests/files/logs/sshd index 1a50d49f..961cd79e 100644 --- a/fail2ban/tests/files/logs/sshd +++ b/fail2ban/tests/files/logs/sshd @@ -414,4 +414,11 @@ Nov 26 16:47:51 srv sshd[19320]: Disconnected from authenticating user root 192. # failJSON: { "time": "2019-07-08T23:40:17", "match": true , "host": "192.0.2.2", "desc": "RFC 5424 format with extra data and brackets in value (gh-2309)" } <38>1 2019-07-08T17:40:17.954167-04:00 hostname.example.com sshd 55555 - [timeQuality tzKnown="1" isSynced="0"][xxx@123 test="[brackets]"] Failed unknown for invalid user redmond from 192.0.2.2 port 55555 ssh2 +# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA field (GHSA-c2mg-2r7g-c3wp)" } +<38>1 2019-07-08T17:40:17.954169-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA 2nd field (GHSA-c2mg-2r7g-c3wp)" } +<38>1 2019-07-08T17:40:17.954170-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA][BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB +# failJSON: { "match": false , "desc": "RFC 5424 format, injection attempt on STRUCTURED-DATA, unescaped new-line in PARAM-VALUE (GHSA-c2mg-2r7g-c3wp)" } +<38>1 2019-07-08T17:40:17.954171-04:00 hostname.example.com sshd 12345 123 [AAAAAAAAAAAAAAAAAAAAAAAAAA XXX="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC + # addFILE: "sshd-journal"