From 3282035568dc83e2d616b097aa8c1695e160f772 Mon Sep 17 00:00:00 2001
From: limuthu123 <168603554+limuthu123@users.noreply.github.com>
Date: Sun, 31 May 2026 01:37:16 +0530
Subject: [PATCH 1/6] fix(db): use parameterized queries to prevent SQL
 injection in getJailNames

---
 fail2ban/server/database.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban/server/database.py b/fail2ban/server/database.py
index 4eba7848..8364b12d 100644
--- a/fail2ban/server/database.py
+++ b/fail2ban/server/database.py
@@ -443,7 +443,7 @@ class Fail2BanDb(object):
 		if enabled is None:
 			cur.execute("SELECT name FROM jails")
 		else:
-			cur.execute("SELECT name FROM jails WHERE enabled=%s" %
+			cur.execute("SELECT name FROM jails WHERE enabled=?",
 				(int(enabled),))
 		return set(row[0] for row in cur.fetchmany())
 

From c6cf3de2929e839b03415262ba0a78e69a0684f3 Mon Sep 17 00:00:00 2001
From: limuthu123 <168603554+limuthu123@users.noreply.github.com>
Date: Sun, 31 May 2026 01:37:22 +0530
Subject: [PATCH 2/6] fix(setup): skip symlink creation on Windows to avoid
 privilege errors

---
 fail2ban/setup.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fail2ban/setup.py b/fail2ban/setup.py
index efaa31a4..392e1b5e 100644
--- a/fail2ban/setup.py
+++ b/fail2ban/setup.py
@@ -30,6 +30,8 @@ def updatePyExec(bindir, executable=None):
 	bindir = os.path.realpath(bindir)
 	if executable is None:
 		executable = sys.executable
+	if sys.platform == 'win32':
+		return
 	pypath = os.path.join(bindir, 'fail2ban-python')
 	# if not exists or point to another version - update link:
 	isfile = os.path.isfile(os.path.realpath(pypath))

From eba577358eda29ebf55511d55dfb86c92a628fa5 Mon Sep 17 00:00:00 2001
From: limuthu123 <168603554+limuthu123@users.noreply.github.com>
Date: Sun, 31 May 2026 01:37:29 +0530
Subject: [PATCH 3/6] refactor: replace bare except blocks with Exception for
 better signal handling

---
 fail2ban/client/configparserinc.py | 4 ++--
 fail2ban/helpers.py                | 2 +-
 fail2ban/server/failregex.py       | 2 +-
 fail2ban/server/filter.py          | 2 +-
 fail2ban/server/filtersystemd.py   | 2 +-
 fail2ban/server/ipdns.py           | 4 ++--
 fail2ban/server/server.py          | 2 +-
 7 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/fail2ban/client/configparserinc.py b/fail2ban/client/configparserinc.py
index 11b9a461..67ea9b28 100644
--- a/fail2ban/client/configparserinc.py
+++ b/fail2ban/client/configparserinc.py
@@ -202,11 +202,11 @@ after = 1.conf
 				rplcmnt = 1
 				try: # set it in map-vars (consider different python versions):
 					defaults[sopt] = v
-				except:
+				except Exception:
 					# try to set in first default map (corresponding vars):
 					try:
 						defaults._maps[0][sopt] = v
-					except: # pragma: no cover
+					except Exception: # pragma: no cover
 						# no way to update vars chain map - overwrite defaults:
 						self._defaults[sopt] = v
 		return rplcmnt
diff --git a/fail2ban/helpers.py b/fail2ban/helpers.py
index 00aca138..b3eb8ad2 100644
--- a/fail2ban/helpers.py
+++ b/fail2ban/helpers.py
@@ -36,7 +36,7 @@ import importlib
 try:
 	import ctypes
 	_libcap = ctypes.CDLL('libcap.so.2')
-except:
+except Exception:
 	_libcap = None
 
 
diff --git a/fail2ban/server/failregex.py b/fail2ban/server/failregex.py
index 85636f36..e016a1e4 100644
--- a/fail2ban/server/failregex.py
+++ b/fail2ban/server/failregex.py
@@ -94,7 +94,7 @@ R_MAP = {
 try:
 	re.search("^re(?i:val)$", "reVAL")
 	R_GLOB2LOCFLAGS = ( re.compile(r"(?<!\\)\((?:\?:)?(\(\?[a-z]+)\)"), r"\1:" )
-except:
+except Exception:
 	R_GLOB2LOCFLAGS = ()
 
 def mapTag2Opt(tag):
diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py
index 44ed13b5..7ecf9023 100644
--- a/fail2ban/server/filter.py
+++ b/fail2ban/server/filter.py
@@ -1314,7 +1314,7 @@ try:
 		md5sum = hashlib.md5
 		# try to use it (several standards like FIPS forbid it):
 		md5sum(' ').hexdigest()
-	except: # pragma: no cover
+	except Exception: # pragma: no cover
 		md5sum = hashlib.sha1
 except ImportError: # pragma: no cover
 	# hashlib was introduced in Python 2.5.  For compatibility with those
diff --git a/fail2ban/server/filtersystemd.py b/fail2ban/server/filtersystemd.py
index 6bb9d466..0259b615 100644
--- a/fail2ban/server/filtersystemd.py
+++ b/fail2ban/server/filtersystemd.py
@@ -194,7 +194,7 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 				ja = self.__jrnlargs
 				super(journal.Reader, self.__journal).__init__(
 					ja.get('flags', 0), ja.get('path'), ja.get('files'), ja.get('namespace'))
-			except:
+			except Exception:
 				# cannot reopen in that way, so simply recreate reader:
 				self.closeJournal()
 				self.__journal = journal.Reader(**self.__jrnlargs)
diff --git a/fail2ban/server/ipdns.py b/fail2ban/server/ipdns.py
index 02e65194..b2389253 100644
--- a/fail2ban/server/ipdns.py
+++ b/fail2ban/server/ipdns.py
@@ -204,7 +204,7 @@ class DNSUtils:
 		# try to obtain from network interfaces if possible (implemented for this platform):
 		try:
 			ips = IPAddrSet([a for ni, a in DNSUtils._NetworkInterfacesAddrs()])
-		except:
+		except Exception:
 			ips = IPAddrSet()
 		# cache and return :
 		DNSUtils.CACHE_nameToIp.set(DNSUtils._getNetIntrfIPs_key, ips)
@@ -257,7 +257,7 @@ class DNSUtils:
 			with open('/proc/sys/net/ipv6/conf/all/disable_ipv6', 'rb') as f:
 				# if 1 - disabled, 0 - enabled
 				return not int(f.read())
-		except:
+		except Exception:
 			pass
 		s = None
 		try:
diff --git a/fail2ban/server/server.py b/fail2ban/server/server.py
index e438c4ca..5b7be07f 100644
--- a/fail2ban/server/server.py
+++ b/fail2ban/server/server.py
@@ -939,7 +939,7 @@ class Server:
 					os.close(fd)
 				except OSError:   # ERROR (ignore)
 					pass
-		except:
+		except Exception:
 			try:
 				maxfd = os.sysconf("SC_OPEN_MAX")
 			except (AttributeError, ValueError):

From 34b42a6390438fcc6c31bab2751e738b50154532 Mon Sep 17 00:00:00 2001
From: limuthu123 <168603554+limuthu123@users.noreply.github.com>
Date: Sun, 31 May 2026 02:01:48 +0530
Subject: [PATCH 4/6] docs: update ChangeLog with security and robustness fixes

---
 ChangeLog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 216ffe88..159a6252 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,6 +18,9 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
   to use it as before set `mode = more` for exim jail, but be aware of the consequences.
 
 ### Fixes
+* Potential SQL injection in database.py using parameterized queries
+* setup.py crash on Windows due to symlink privilege requirements
+* Bare except blocks replaced with Exception to improve signal handling
 * fixes `systemd` bug with missing journal descriptor after rotation by reopening of journal if it is recognized as not alive (gh-3929)
 * improve threaded clean-up of all filters, new thread functions `afterStop` (to force clean-up after stop) and `done`, invoking `afterStop` once
 * ensure journal-reader is always closed (additional prevention against leaks and "too many open files"), thereby avoid sporadic segfault

From c3fdd03e1b54c8d4f190d7b4b8ec5bf9756acd9d Mon Sep 17 00:00:00 2001
From: limuthu123 <168603554+limuthu123@users.noreply.github.com>
Date: Sun, 31 May 2026 12:37:33 +0530
Subject: [PATCH 5/6] ufw: fix fail2ban logs error when using
 kill-mode=conntrack

Ignore exit code 1 from conntrack -D and ss -K (no entries deleted) and skip kill commands during restoration.
---
 config/action.d/ufw.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/action.d/ufw.conf b/config/action.d/ufw.conf
index 060093a0..e77b7df9 100644
--- a/config/action.d/ufw.conf
+++ b/config/action.d/ufw.conf
@@ -39,8 +39,8 @@ kill-mode =
 
 # intern conditional parameter used to provide killing mode after ban:
 _kill_ =
-_kill_ss = ss -K dst "[<ip>]"
-_kill_conntrack = conntrack -D -s "<ip>"
+_kill_ss = if [ "<restored>" != "1" ]; then ss -K dst "[<ip>]" || [ $? -eq 1 ]; fi
+_kill_conntrack = if [ "<restored>" != "1" ]; then conntrack -D -s "<ip>" || [ $? -eq 1 ]; fi
 
 # Option: kill
 # Notes.: can be used to specify custom killing feature, by default depending on option kill-mode

From 4b1ffbe52e792cfaa30691c8b3ecae09afa45c1e Mon Sep 17 00:00:00 2001
From: limuthu123 <168603554+limuthu123@users.noreply.github.com>
Date: Mon, 1 Jun 2026 09:34:53 +0530
Subject: [PATCH 6/6] revert: robustness and platform changes as per maintainer
 feedback

---
 ChangeLog                          | 2 --
 config/action.d/ufw.conf           | 4 ++--
 fail2ban/client/configparserinc.py | 4 ++--
 fail2ban/helpers.py                | 2 +-
 fail2ban/server/failregex.py       | 2 +-
 fail2ban/server/filter.py          | 2 +-
 fail2ban/server/filtersystemd.py   | 2 +-
 fail2ban/server/ipdns.py           | 4 ++--
 fail2ban/server/server.py          | 2 +-
 fail2ban/setup.py                  | 2 --
 10 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 159a6252..1e30b2e6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,8 +19,6 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
 
 ### Fixes
 * Potential SQL injection in database.py using parameterized queries
-* setup.py crash on Windows due to symlink privilege requirements
-* Bare except blocks replaced with Exception to improve signal handling
 * fixes `systemd` bug with missing journal descriptor after rotation by reopening of journal if it is recognized as not alive (gh-3929)
 * improve threaded clean-up of all filters, new thread functions `afterStop` (to force clean-up after stop) and `done`, invoking `afterStop` once
 * ensure journal-reader is always closed (additional prevention against leaks and "too many open files"), thereby avoid sporadic segfault
diff --git a/config/action.d/ufw.conf b/config/action.d/ufw.conf
index e77b7df9..060093a0 100644
--- a/config/action.d/ufw.conf
+++ b/config/action.d/ufw.conf
@@ -39,8 +39,8 @@ kill-mode =
 
 # intern conditional parameter used to provide killing mode after ban:
 _kill_ =
-_kill_ss = if [ "<restored>" != "1" ]; then ss -K dst "[<ip>]" || [ $? -eq 1 ]; fi
-_kill_conntrack = if [ "<restored>" != "1" ]; then conntrack -D -s "<ip>" || [ $? -eq 1 ]; fi
+_kill_ss = ss -K dst "[<ip>]"
+_kill_conntrack = conntrack -D -s "<ip>"
 
 # Option: kill
 # Notes.: can be used to specify custom killing feature, by default depending on option kill-mode
diff --git a/fail2ban/client/configparserinc.py b/fail2ban/client/configparserinc.py
index 67ea9b28..11b9a461 100644
--- a/fail2ban/client/configparserinc.py
+++ b/fail2ban/client/configparserinc.py
@@ -202,11 +202,11 @@ after = 1.conf
 				rplcmnt = 1
 				try: # set it in map-vars (consider different python versions):
 					defaults[sopt] = v
-				except Exception:
+				except:
 					# try to set in first default map (corresponding vars):
 					try:
 						defaults._maps[0][sopt] = v
-					except Exception: # pragma: no cover
+					except: # pragma: no cover
 						# no way to update vars chain map - overwrite defaults:
 						self._defaults[sopt] = v
 		return rplcmnt
diff --git a/fail2ban/helpers.py b/fail2ban/helpers.py
index b3eb8ad2..00aca138 100644
--- a/fail2ban/helpers.py
+++ b/fail2ban/helpers.py
@@ -36,7 +36,7 @@ import importlib
 try:
 	import ctypes
 	_libcap = ctypes.CDLL('libcap.so.2')
-except Exception:
+except:
 	_libcap = None
 
 
diff --git a/fail2ban/server/failregex.py b/fail2ban/server/failregex.py
index e016a1e4..85636f36 100644
--- a/fail2ban/server/failregex.py
+++ b/fail2ban/server/failregex.py
@@ -94,7 +94,7 @@ R_MAP = {
 try:
 	re.search("^re(?i:val)$", "reVAL")
 	R_GLOB2LOCFLAGS = ( re.compile(r"(?<!\\)\((?:\?:)?(\(\?[a-z]+)\)"), r"\1:" )
-except Exception:
+except:
 	R_GLOB2LOCFLAGS = ()
 
 def mapTag2Opt(tag):
diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py
index 7ecf9023..44ed13b5 100644
--- a/fail2ban/server/filter.py
+++ b/fail2ban/server/filter.py
@@ -1314,7 +1314,7 @@ try:
 		md5sum = hashlib.md5
 		# try to use it (several standards like FIPS forbid it):
 		md5sum(' ').hexdigest()
-	except Exception: # pragma: no cover
+	except: # pragma: no cover
 		md5sum = hashlib.sha1
 except ImportError: # pragma: no cover
 	# hashlib was introduced in Python 2.5.  For compatibility with those
diff --git a/fail2ban/server/filtersystemd.py b/fail2ban/server/filtersystemd.py
index 0259b615..6bb9d466 100644
--- a/fail2ban/server/filtersystemd.py
+++ b/fail2ban/server/filtersystemd.py
@@ -194,7 +194,7 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover
 				ja = self.__jrnlargs
 				super(journal.Reader, self.__journal).__init__(
 					ja.get('flags', 0), ja.get('path'), ja.get('files'), ja.get('namespace'))
-			except Exception:
+			except:
 				# cannot reopen in that way, so simply recreate reader:
 				self.closeJournal()
 				self.__journal = journal.Reader(**self.__jrnlargs)
diff --git a/fail2ban/server/ipdns.py b/fail2ban/server/ipdns.py
index b2389253..02e65194 100644
--- a/fail2ban/server/ipdns.py
+++ b/fail2ban/server/ipdns.py
@@ -204,7 +204,7 @@ class DNSUtils:
 		# try to obtain from network interfaces if possible (implemented for this platform):
 		try:
 			ips = IPAddrSet([a for ni, a in DNSUtils._NetworkInterfacesAddrs()])
-		except Exception:
+		except:
 			ips = IPAddrSet()
 		# cache and return :
 		DNSUtils.CACHE_nameToIp.set(DNSUtils._getNetIntrfIPs_key, ips)
@@ -257,7 +257,7 @@ class DNSUtils:
 			with open('/proc/sys/net/ipv6/conf/all/disable_ipv6', 'rb') as f:
 				# if 1 - disabled, 0 - enabled
 				return not int(f.read())
-		except Exception:
+		except:
 			pass
 		s = None
 		try:
diff --git a/fail2ban/server/server.py b/fail2ban/server/server.py
index 5b7be07f..e438c4ca 100644
--- a/fail2ban/server/server.py
+++ b/fail2ban/server/server.py
@@ -939,7 +939,7 @@ class Server:
 					os.close(fd)
 				except OSError:   # ERROR (ignore)
 					pass
-		except Exception:
+		except:
 			try:
 				maxfd = os.sysconf("SC_OPEN_MAX")
 			except (AttributeError, ValueError):
diff --git a/fail2ban/setup.py b/fail2ban/setup.py
index 392e1b5e..efaa31a4 100644
--- a/fail2ban/setup.py
+++ b/fail2ban/setup.py
@@ -30,8 +30,6 @@ def updatePyExec(bindir, executable=None):
 	bindir = os.path.realpath(bindir)
 	if executable is None:
 		executable = sys.executable
-	if sys.platform == 'win32':
-		return
 	pypath = os.path.join(bindir, 'fail2ban-python')
 	# if not exists or point to another version - update link:
 	isfile = os.path.isfile(os.path.realpath(pypath))