Skip to content
Fencer Vulns
medium 6.1

CVE-2021-32749 json

Possible RCE vulnerability in mailing action using mailutils (mail-whois)

published 2021-07-16 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19521

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.4%
EPSS 3.4% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command `mail` from mailutils package used in mail actions like `mail-whois` can execute command if unescaped sequences (`\n~`) are available in "foreign" input (for instance in whois output). To exploit the vulnerability, an attacker would need to insert malicious characters into the response sent by the whois server, either via a MITM attack or by taking over a whois server. The issue is patched in versions 0.10.7 and 0.11.3. As a workaround, one may avoid the usage of action `mail-whois` or patch the vulnerability manually.

Patch / fix

  • fail2ban fail2ban 0.10.7, 0.11.3
  • fail2ban Debian 14, Debian 13, Debian 12 0.11.2-2

debian advisories DEBIAN-CVE-2021-32749

  • fail2ban Ubuntu Pro 14.04 LTS 0.8.11-1ubuntu0.1~esm1
  • fail2ban Ubuntu Pro 16.04 LTS 0.9.3-1ubuntu0.1~esm1
  • fail2ban Ubuntu Pro 18.04 LTS 0.10.2-2ubuntu0.1~esm1
  • fail2ban Ubuntu Pro 20.04 LTS 0.11.1-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-32749

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • fail2ban openSUSE Tumbleweed 0.11.2-3.1
  • fail2ban Package Hub 15 SP3, Package Hub 15 SP2, Package Hub 15 SP1 +2 more 0.11.2-bp153.2.3.1

opensuse advisories openSUSE-SU-2024:10749-1openSUSE-SU-2021:1274-1

  • fail2ban Alpine 3.15 0.11.2-r1
  • fail2ban Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 0.11.2-r2

alpine advisories ALPINE-CVE-2021-32749

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • fail2ban Arch Linux 0.11.2-2

arch linux advisories AVG-2169

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32749 updated cvss 7.5

fail2ban: Command injection via mail comand

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.43% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • fail2ban fail2ban

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.