Opened 4 months ago

Closed 2 months ago

#23412 closed enhancement (fixed)

proftpd-1.3.9b

Reported by: Bruce Dubbs Owned by: SecurityAdvisory
Priority: elevated Milestone: 98-Security
Component: BOOK Version: git
Severity: medium Keywords:
Cc:

Description

New point version.

Change History (5)

comment:1 by Joe Locash, 4 months ago

Owner: changed from blfs-book to Joe Locash
Status: new → assigned

comment:2 by Joe Locash, 4 months ago

Owner: changed from Joe Locash to SecurityAdvisory
Status: assigned → new 
1.3.9b - Released 02-Jun-2026
--------------------------------
- Issue 2057 - SQL Injection in mod_wrap2_sql via reverse DNS
  hostname (CVE-2026-44331).
- Issue 2056 - Incomplete fix for session management with OpenSSL 3.2.x or
  later, when using TLSv1.2 or earlier.  This complements the fix for
  Issue #1963.
- Issue 2098 - Hard quota limits on uploads do not cause SFTP WRITE requests
  to fail as expected.
- Issue 2102 - SSH payload length underflow calculation for ETM/ChaChaPoly
  algorithms in mod_sftp.
- Issue 2104 - SSH packet with empty payload triggers null pointer dereference
  in mod_sftp.
- Issue 2106 - Bad DSA signatures can lead to out-of-bounds read of heap memory
  in mod_sftp.
- Issue 2108 - Mismatched RSA/DSA algorithm signatures can lead to null
  dereference in mod_sftp.
- Issue 2115 - SFTP request payload length underflow calculation in mod_sftp.
- Issue 2120 - Several modules fail to build using OpenSSL 4.0.

Fixed at 6ee20c37d6. Leaving open for SA.

comment:3 by Joe Locash, 4 months ago

Priority: normal → elevated

comment:4 by Bruce Dubbs, 3 months ago

Milestone: 13.1 → 98-Security

comment:5 by Bruce Dubbs, 2 months ago

Resolution: → fixed
Status: new → closed

Advisory sa-13.0-159 has been issued.

Note: See TracTickets for help on using tickets.