Bug#1142828: trixie-pu: package proftpd-dfsg/1.3.8.c+dfsg-4+deb13u3

--sqb4ayPzqRzitxo9
Content-Type: multipart/mixed; boundary="AS4QeP3o6hLk4Lss"
Content-Disposition: inline


--AS4QeP3o6hLk4Lss
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:proftpd-dfsg
User: [email protected]
Usertags: pu

(Please provide enough information to help the release team
to judge the request efficiently. E.g. by filling in the
sections below.)

[ Reason ]
There were a few security leaks recently discovered in the proftp
code. This update addresses these leaks (see below in [Changes]).

[ Impact ]
If the update is not approved, the existing proftp installations
will further suffer from the security leaks in question.

[ Tests ]
The proftp package has an automated test suite, which runs successful
even after applying the pataches.

[ Risks ]
See tests.

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
The update contains the 4 patches to address CVE-2026-44331 /
CVE-2026-53994 / CVE-2026-63091 / CVE-2026-63090

[ Other info ]
N/A.

--AS4QeP3o6hLk4Lss
Content-Type: text/x-diff; charset=iso-8859-1
Content-Disposition: attachment; filename="deb13u2_deb13u3.diff"
Content-Transfer-Encoding: quoted-printable

diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/changelog proftpd-dfsg-1.3.8.c+d=
fsg/debian/changelog
--- proftpd-dfsg-1.3.8.c+dfsg/debian/changelog	2026-05-01 12:48:15.00000000=
0 +0200
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/changelog	2026-07-22 22:58:45.00000000=
0 +0200
@@ -1,3 +1,12 @@
+proftpd-dfsg (1.3.8.c+dfsg-4+deb13u3) trixie; urgency=3Dmedium
+
+  * Add patch for CVE-2026-44331 (Closes: #1135840).
+  * Add patch for CVE-2026-53994.
+  * Add patch for CVE-2026-63091.
+  * Add patch for CVE-2026-63090.
+
+ -- Hilmar Preu=DFe <[email protected]>  Wed, 22 Jul 2026 22:58:45 +0200
+
 proftpd-dfsg (1.3.8.c+dfsg-4+deb13u2) trixie; urgency=3Dmedium
=20
   * Add patch for CVE-2026-42167 (Closes: #1135119).
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/gitlab-ci.yml proftpd-dfsg-1.3.8=
=2Ec+dfsg/debian/gitlab-ci.yml
--- proftpd-dfsg-1.3.8.c+dfsg/debian/gitlab-ci.yml	2026-05-01 12:47:52.0000=
00000 +0200
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/gitlab-ci.yml	2026-07-22 22:58:45.0000=
00000 +0200
@@ -7,9 +7,11 @@
 variables:
   SALSA_CI_DISABLE_APTLY: 0
   SALSA_CI_DISABLE_AUTOPKGTEST: 1
+  SALSA_CI_DISABLE_DEBREBUILD: 1
   SALSA_CI_DISABLE_BLHC: 1
   SALSA_CI_DISABLE_LINTIAN: 0
   SALSA_CI_DISABLE_PIUPARTS: 0
   SALSA_CI_DISABLE_REPROTEST: 1
   SALSA_CI_DISABLE_BUILD_PACKAGE_ALL: 0
-  SALSA_CI_DISABLE_BUILD_PACKAGE_ANY: 0
\ No newline at end of file
+  SALSA_CI_DISABLE_BUILD_PACKAGE_ANY: 0
+  SALSA_CI_DISABLE_USCAN: 1
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/07797aba88dca902da7eaf1d=
fe262c8896943de7.diff proftpd-dfsg-1.3.8.c+dfsg/debian/patches/07797aba88dc=
a902da7eaf1dfe262c8896943de7.diff
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/07797aba88dca902da7eaf1dfe262c=
8896943de7.diff	1970-01-01 01:00:00.000000000 +0100
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/07797aba88dca902da7eaf1dfe262c=
8896943de7.diff	2026-05-23 10:50:34.000000000 +0200
@@ -0,0 +1,103 @@
+From 07797aba88dca902da7eaf1dfe262c8896943de7 Mon Sep 17 00:00:00 2001
+From: TJ Saunders <[email protected]>
+Date: Tue, 5 May 2026 09:56:33 -0700
+Subject: [PATCH] Issue #2057: Properly escape the "name" provided when doi=
ng
+ SQL lookups for allowed/denied client IP addresses or DNS names.
+
+---
+ contrib/mod_wrap2_sql.c | 49 +++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 45 insertions(+), 4 deletions(-)
+
+diff --git a/contrib/mod_wrap2_sql.c b/contrib/mod_wrap2_sql.c
+index eaf6ea7dc5..d4fd56e699 100644
+--- a/contrib/mod_wrap2_sql.c
++++ b/contrib/mod_wrap2_sql.c
+@@ -1,7 +1,7 @@
+ /*
+  * ProFTPD: mod_wrap2_sql -- a mod_wrap2 sub-module for supplying IP-based
+  *                           access control data via SQL tables
+- * Copyright (c) 2002-2016 TJ Saunders
++ * Copyright (c) 2002-2026 TJ Saunders
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -25,7 +25,7 @@
+ #include "mod_wrap2.h"
+ #include "mod_sql.h"
+=20
+-#define MOD_WRAP2_SQL_VERSION		"mod_wrap2_sql/1.0"
++#define MOD_WRAP2_SQL_VERSION		"mod_wrap2_sql/1.1"
+=20
+ #define WRAP2_SQL_NSLOTS		2
+ #define WRAP2_SQL_CLIENT_QUERY_IDX	0
+@@ -62,6 +62,41 @@ static int sqltab_close_cb(wrap2_table_t *sqltab) {
+   return 0;
+ }
+=20
++static char *sqltab_get_escaped_text(pool *p, wrap2_table_t *sqltab,
++    const char *text) {
++  pool *tmp_pool =3D NULL;
++  cmdtable *sql_cmdtab =3D NULL;
++  cmd_rec *sql_cmd =3D NULL;
++  modret_t *sql_res =3D NULL;
++
++  /* Find the cmdtable for the sql_escapestr command, as the provided
++   * name needs to be properly escaped for SQL syntax; see Issue #2057.
++   */
++  sql_cmdtab =3D pr_stash_get_symbol2(PR_SYM_HOOK, "sql_escapestr", NULL,=
 NULL,
++    NULL);
++  if (sql_cmdtab =3D=3D NULL) {
++    wrap2_log("error: unable to find SQL hook symbol 'sql_escapestr': "
++      "perhaps your proftpd.conf needs 'LoadModule mod_sql.c'?");
++    return NULL;
++  }
++
++  sql_cmd =3D sql_cmd_create(tmp_pool, 1, text);
++  sql_res =3D pr_module_call(sql_cmdtab->m, sql_cmdtab->handler, sql_cmd);
++  if (sql_res =3D=3D NULL) {
++    wrap2_log("sql_escapestr '%s' returned no data; "
++      "see the mod_sql.c SQLLogFile for more details", text);
++    return NULL;
++  }
++
++  if (MODRET_ISERROR(sql_res)) {
++    wrap2_log("error processing sql_escapestr '%s': "
++      "check the mod_sql.c SQLLogFile for more details", text);
++    return NULL;
++  }
++
++  return sql_res->data;
++}
++
+ static array_header *sqltab_fetch_clients_cb(wrap2_table_t *sqltab,
+     const char *name) {
+   register unsigned int i;
+@@ -70,12 +105,18 @@ static array_header *sqltab_fetch_clients_cb(wrap2_ta=
ble_t *sqltab,
+   cmd_rec *sql_cmd =3D NULL;
+   modret_t *sql_res =3D NULL;
+   array_header *sql_data =3D NULL;
+-  char *query =3D NULL, **vals =3D NULL;
++  char *escaped_name =3D NULL, *query =3D NULL, **vals =3D NULL;
+   array_header *clients_list =3D NULL;
+=20
+   /* Allocate a temporary pool for the duration of this read. */
+   tmp_pool =3D make_sub_pool(sqltab->tab_pool);
+=20
++  escaped_name =3D sqltab_get_escaped_text(tmp_pool, sqltab, name);
++  if (escaped_name =3D=3D NULL) {
++    destroy_pool(tmp_pool);
++    return NULL;
++  }
++
+   query =3D ((char **) sqltab->tab_data)[WRAP2_SQL_CLIENT_QUERY_IDX];
+=20
+   /* Find the cmdtable for the sql_lookup command. */
+@@ -89,7 +130,7 @@ static array_header *sqltab_fetch_clients_cb(wrap2_tabl=
e_t *sqltab,
+   }
+=20
+   /* Prepare the SELECT query. */
+-  sql_cmd =3D sql_cmd_create(tmp_pool, 3, "sql_lookup", query, name);
++  sql_cmd =3D sql_cmd_create(tmp_pool, 3, "sql_lookup", query, escaped_na=
me);
+=20
+   /* Call the handler. */
+   sql_res =3D pr_module_call(sql_cmdtab->m, sql_cmdtab->handler, sql_cmd);
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/baf4b7929758c72cdb6cf163=
25fa25f435d23db6.diff proftpd-dfsg-1.3.8.c+dfsg/debian/patches/baf4b7929758=
c72cdb6cf16325fa25f435d23db6.diff
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/baf4b7929758c72cdb6cf16325fa25=
f435d23db6.diff	1970-01-01 01:00:00.000000000 +0100
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/baf4b7929758c72cdb6cf16325fa25=
f435d23db6.diff	2026-07-22 22:58:45.000000000 +0200
@@ -0,0 +1,49 @@
+From baf4b7929758c72cdb6cf16325fa25f435d23db6 Mon Sep 17 00:00:00 2001
+From: TJ Saunders <[email protected]>
+Date: Wed, 1 Jul 2026 09:14:38 -0700
+Subject: [PATCH] Exercise caution when reading the client-provided file si=
ze
+ for SCP uploads, as it could possibly overflow our size type.
+
+Thanks to Fabian Wahle of Hap Security for reporting this issue.
+---
+ contrib/mod_sftp/scp.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/contrib/mod_sftp/scp.c b/contrib/mod_sftp/scp.c
+index 8c105587f..b1f3e89ae 100644
+--- a/contrib/mod_sftp/scp.c
++++ b/contrib/mod_sftp/scp.c
+@@ -603,16 +603,27 @@ static int recv_perms(pool *p, uint32_t channel_id, =
char *mode_str,
+=20
+ static int recv_filesz(pool *p, uint32_t channel_id, char *size_str,
+     off_t *filesz) {
+-  register unsigned int i;
++  char *endp =3D NULL;
++  unsigned long long sz;
++  *filesz =3D 0;
+=20
+-  /* The file size field could be of arbitrary length. */
+-  for (i =3D 0, *filesz =3D 0; PR_ISDIGIT(size_str[i]); i++) {
+-    pr_signals_handle();
++#if defined(HAVE_STROULL)
++  sz =3D strtoull(size_str, &endp, 10);
++#else
++  sz =3D strtoul(size_str, &endp, 10);
++#endif /* HAVE_STROULL */
+=20
+-    *filesz =3D (*filesz * 10) + (size_str[i] - '0');
++  *filesz =3D (off_t) sz;
++
++  /* Watch for cases where the sent file size might overflow our size typ=
e. */
++  if (*filesz < 0) {
++    pr_trace_msg(trace_channel, 2, "file size out of range");
++    write_confirm(p, channel_id, 1, "file size out of range");
++    return -1;
+   }
+=20
+-  if (size_str[i] !=3D ' ') {
++  if (endp =3D=3D NULL ||
++      *endp !=3D ' ') {
+     pr_trace_msg(trace_channel, 2, "file size not followed by space delim=
iter");
+     write_confirm(p, channel_id, 1, "file size not delimited");
+     return -1;
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue211=
5.diff proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2115.d=
iff
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2115.diff=
	1970-01-01 01:00:00.000000000 +0100
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2115.diff=
	2026-07-22 22:58:45.000000000 +0200
@@ -0,0 +1,44 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..8e867649c 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -3381,6 +3381,23 @@ static struct fxp_packet *fxp_packet_read(uint32_t =
channel_id,
+       "(%lu bytes remaining in buffer)", (unsigned long) fxp->packet_len,
+       (unsigned long) buflen);
+=20
++    /* We require 5 bytes of SFTP request data at a minimum: 1 byte for t=
he
++     * request type, and 4 bytes for the payload length (Issue #2115).
++     */
++    if (fxp->packet_len < 5) {
++      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++        "illegal SFTP request length (%lu bytes, require at least 5 bytes=
), "
++        "rejecting", (unsigned long) fxp->packet_len);
++      SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++    }
++
++    if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
++      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++        "received excessive SFTP packet (len %lu > max %lu bytes), reject=
ing",
++        (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_L=
EN);
++      SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++    }
++
+     if (buflen =3D=3D 0) {
+       fxp_packet_set_packet(fxp);
+       fxp_packet_clear_cache();
+@@ -13674,15 +13691,6 @@ int sftp_fxp_handle_packet(pool *p, void *ssh2, u=
int32_t channel_id,
+         (unsigned long) channel_id);
+     }
+=20
+-    if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
+-      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+-        "received excessive SFTP packet (len %lu > max %lu bytes), reject=
ing",
+-        (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_L=
EN);
+-      destroy_pool(fxp->pool);
+-      errno =3D EPERM;
+-      return -1;
+-    }
+-
+     fxp_session =3D fxp_get_session(channel_id);
+     if (fxp_session =3D=3D NULL) {
+       (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue219=
0.diff proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2190.d=
iff
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2190.diff=
	1970-01-01 01:00:00.000000000 +0100
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2190.diff=
	2026-07-22 22:58:45.000000000 +0200
@@ -0,0 +1,81 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..a7631eaa4 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -264,11 +264,11 @@ struct fxp_buffer {
+ #define	FXP_PACKET_HAVE_PAYLOAD_SIZE	0x0008
+ #define	FXP_PACKET_HAVE_PAYLOAD		0x0010
+=20
+-/* After 32K of allocation from the scratch SFTP payload pool, destroy the
++/* After 64K of allocation from the scratch SFTP payload pool, destroy the
+  * pool and create a new one.  This will prevent unbounded allocation
+  * from the pool.
+  */
+-#define FXP_PACKET_DATA_ALLOC_MAX_SZ		(1024 * 32)
++#define FXP_PACKET_DATA_ALLOC_MAX_SZ		(1024 * 64)
+ static size_t fxp_packet_data_allocsz =3D 0;
+=20
+ #define FXP_PACKET_DATA_DEFAULT_SZ		(1024 * 16)
+@@ -3288,37 +3288,45 @@ static void fxp_packet_add_cache(unsigned char *da=
ta, uint32_t datalen) {
+=20
+     } else {
+       /* We need a larger buffer.  Round up to the nearest 1K size. */
++      pool *tmp_pool;
++      char *cached_data;
++      uint32_t cached_datalen;
+       size_t sz;
+=20
+-      sz =3D sftp_crypto_get_size(curr_buflen + datalen + 1, 1024);
++      if (curr_buflen + datalen > FXP_MAX_PACKET_LEN) {
++        (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++          "received excessive SFTP data (len %lu > max %lu bytes), reject=
ing",
++          (unsigned long) curr_buflen + datalen,
++          (unsigned long) FXP_MAX_PACKET_LEN);
++        SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++      }
+=20
+-      if (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ) {
+-        pool *tmp_pool;
+-        char *tmp_data;
+-        uint32_t tmp_datalen;
++      /* Get the existing cached data before allocating a larger buffer. =
*/
++      tmp_pool =3D make_sub_pool(fxp_pool);
++
++      cached_datalen =3D curr_buflen;
++      cached_data =3D palloc(tmp_pool, cached_datalen);
++      memcpy(cached_data, curr_buf, cached_datalen);
+=20
++      if (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ) {
+         (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+           "renewing SFTP packet data pool");
+=20
+-        tmp_pool =3D make_sub_pool(fxp_pool);
+-        tmp_datalen =3D curr_buflen;
+-        tmp_data =3D palloc(tmp_pool, tmp_datalen);               =20
+-        memcpy(tmp_data, curr_buf, tmp_datalen);
+-       =20
+         destroy_pool(curr_buf_pool);
+=20
+         curr_buf_pool =3D make_sub_pool(fxp_pool);
+         pr_pool_tag(curr_buf_pool, "SFTP packet buffer pool");
++      }
+=20
+-        curr_bufsz =3D sz;
+-        curr_buf =3D palloc(curr_buf_pool, curr_bufsz);
+-        fxp_packet_data_allocsz +=3D sz;
++      sz =3D sftp_crypto_get_size(curr_buflen + datalen + 1, 1024);
++      curr_bufsz =3D sz;
++      curr_buf =3D palloc(curr_buf_pool, curr_bufsz);
++      fxp_packet_data_allocsz +=3D sz;
+=20
+-        memcpy(curr_buf, tmp_data, tmp_datalen);
+-        curr_buflen =3D tmp_datalen;
++      memcpy(curr_buf, cached_data, cached_datalen);
++      curr_buflen =3D cached_datalen;
+=20
+-        destroy_pool(tmp_pool);
+-      }
++      destroy_pool(tmp_pool);
+     }
+=20
+     /* Append the SSH2 data to the current unconsumed buffer.
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/series proftpd-dfsg-1.3.=
8.c+dfsg/debian/patches/series
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/series	2026-05-01 12:47:52.000=
000000 +0200
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/series	2026-07-22 22:58:45.000=
000000 +0200
@@ -21,3 +21,11 @@
 14c006b62c09d1efe302c57b2d183a489bcb22dc.diff
 9b2b4a3e32d251798bf8fa841b124ab15ba58f11.diff
 2052_pghmcfc.diff
+# issue 2057, CVE-2026-44331
+07797aba88dca902da7eaf1dfe262c8896943de7.diff
+# issue 2115, CVE-2026-53994
+mod_sftp-1.3.8d-issue2115.diff
+# issue 2201, CVE-2026-63091
+baf4b7929758c72cdb6cf16325fa25f435d23db6.diff
+# issue 2190, CVE-2026-63090
+mod_sftp-1.3.8d-issue2190.diff

--AS4QeP3o6hLk4Lss--

--sqb4ayPzqRzitxo9
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iNUEABYKAH0WIQRKnq6Z0VRDf4bMmAn98EQ6ARgcNAUCamZbmF8UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0NEE5
RUFFOTlEMTU0NDM3Rjg2Q0M5ODA5RkRGMDQ0M0EwMTE4MUMzNAAKCRD98EQ6ARgc
NExlAP92ba9rbeqzbdwCE/tk7bwxxWuNOGnSEDRdvsvmRFxcYAEAsl21Xr/9JNDb
0kLf1slrWnmFYB1kBQzp6OL/G0R2dgQ=
=coDa
-----END PGP SIGNATURE-----

--sqb4ayPzqRzitxo9--