5.4.0 changed tag from wordpress -> WordPress --> filter fails

There seems to be some missmatch in the version hosted at WordPressOrg vs. GitHub.

In lib/syslog.php the file wp-fail2ban.5.4.0.zip from WordPressOrg contains a changed tag “WordPress” in getLine().

Example log line from auth.log:

2025-01-28T10:31:22.288579+01:00 wordpress.example.com WordPress(wordpress.example.com/)[3988751]: Authentication attempt for unknown user newadminuser1 from 123.123.123.123

But in the GitHub version, this tag ist still written in lowercase as “wordpress”.

So after automatically updating from WordPressOrg the fail2ban filter does not work anymore. Hope to see a fix 5.4.1 soon.

same her. Luckily my logcheck rule also failed and i saw the attacks…
I updated my Filters:
_daemon = (?:wordpress|wp|WordPress)
seams to work…

Quick update: v5.4.0.1 is available now.

1 Like

Postmortem now available.