On: Analyzing the attacks on my website

[omgwtfbyobbq]

How does fail2ban expose attack surface?

[detaro → omgwtfbyobbq]

It's code running on partially attacker-controlled inputs. It several times had vulnerabilities that allowed an attacker to trigger blocks for arbitrary IPs.

[cyc115 → omgwtfbyobbq]

I remember there's a privEsc on old versions of fail2ban.

[omgwtfbyobbq → cyc115]

Do you remember roughly when the privEsc was?

https://www.cvedetails.com/vulnerability-list/vendor_id-5567...

[ryanlol → omgwtfbyobbq]

Sketchy parsers operating on untrusted, unstructured log data.

fail2ban is worse than useless.