CVE-2013-7176
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote...
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
Exploit likelihood
What each source reports
NVD Score used
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
- Record
CVE-2013-7176- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
- Record
CVE-2013-7176- Updated
- 2026-11-02
EUVDEUVD-2013-6959 No score
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
- Record
EUVD-2013-6959- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c3p6-cwjh-4h46 No score
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote...
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
- Record
GHSA-c3p6-cwjh-4h46- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
- Record
CVE-2013-7176- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-7176 No score
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
- Record
DEBIAN-CVE-2013-7176- Updated
- 2026-11-02
OSVMGASA-2014-0176 No score
Updated fail2ban packages fix security issues
An update to fail2ban 0.8.13 has been released to fix security issues, amongst other bugfixes.
fail2ban versions prior to 0.8.11 would allow a remote unauthenticated attacker to cause arbitrary IP addresses to be blocked by Fail2ban causing legitimate users to be blocked from accessing services protected by Fail2ban. These services are cyrus-imap (CVE-2013-7177) and postfix (CVE-2013-7176).
- Record
MGASA-2014-0176- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10347-1 No score
SuSEfirewall2-fail2ban-0.9.5-1.1 on GA media
These are all security issues fixed in the SuSEfirewall2-fail2ban-0.9.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10347-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-7176 No score
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
- Record
UBUNTU-CVE-2013-7176- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fail2banDebian:12 |
before 0.8.11-1 | 0.8.11-1 |
fail2banDebian:13 |
before 0.8.11-1 | 0.8.11-1 |
fail2banDebian:14 |
before 0.8.11-1 | 0.8.11-1 |
fail2banDebian:6.0 From an advisory covering 2 CVEs |
before 0.8.4-3+squeeze3, plus listed versions 0.8.4-30.8.4-3+squeeze10.8.4-3+squeeze2 |
0.8.4-3+squeeze3 |
fail2banDebian:7 From an advisory covering 2 CVEs |
before 0.8.6-3wheezy3, plus listed versions 0.8.6-3wheezy10.8.6-3wheezy2 |
0.8.6-3wheezy3 |
fail2banMageia:3 From an advisory covering 2 CVEs |
before 0.8.13-2.mga3 | 0.8.13-2.mga3 |
fail2banMageia:4 From an advisory covering 2 CVEs |
before 0.8.13-2.mga4 | 0.8.13-2.mga4 |
fail2banopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 0.9.5-1.1 | 0.9.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7176 is a medium vulnerability (CVSS 5.0) in Fail2ban, published February 1, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.23%, the 88th percentile. Fixed in fail2ban 0.8.11-1.
References
kb.cert.org/vuls/id/686662
lists.opensuse.org/opensuse-updates/2014-03/msg00021.html
debian.org/security/2014/dsa-2979
github.com/fail2ban/fail2ban/commit/eb2f0c927257120dfc32d2450fd63f1962f38821
nvd.nist.gov/vuln/detail/CVE-2013-7176
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2013-7176
advisories.mageia.org/MGASA-2014-0176.html
bugs.mageia.org/show_bug.cgi?id=11569
ubuntu.com/security/CVE-2013-7176
cve.org/CVERecord?id=CVE-2013-7176
suse.com/security/cve/CVE-2009-5023