https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 08:05:13 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-109786 <p>In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an &#34;on &lt;token&gt;&#34; suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as &#34;x VICTIM-SOURCE-IP-ADDRESS on&#34; to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.</p> <p>In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an &#34;on &lt;token&gt;&#34; suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as &#34;x VICTIM-SOURCE-IP-ADDRESS on&#34; to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.</p> https://db.gcve.eu/vuln/fkie_cve-2026-109786 https://db.gcve.eu/vuln/ghsa-xw36-3g63-5wfw <p>In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an &#34;on &lt;token&gt;&#34; suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as &#34;x VICTIM-SOURCE-IP-ADDRESS on&#34; to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.</p> <p>In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an &#34;on &lt;token&gt;&#34; suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as &#34;x VICTIM-SOURCE-IP-ADDRESS on&#34; to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.</p> https://db.gcve.eu/vuln/ghsa-xw36-3g63-5wfw