Re: [BLFS Trac] #23412: proftpd-1.3.9b

#23412: proftpd-1.3.9b
-------------------------+-------------------------------
 Reporter:  Bruce Dubbs  |       Owner:  SecurityAdvisory
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-------------------------------
Changes (by Joe Locash):

 * owner:  Joe Locash => SecurityAdvisory
 * status:  assigned => new

Comment:

 {{{
 1.3.9b - Released 02-Jun-2026
 --------------------------------
 - Issue 2057 - SQL Injection in mod_wrap2_sql via reverse DNS
   hostname (CVE-2026-44331).
 - Issue 2056 - Incomplete fix for session management with OpenSSL 3.2.x or
   later, when using TLSv1.2 or earlier.  This complements the fix for
   Issue #1963.
 - Issue 2098 - Hard quota limits on uploads do not cause SFTP WRITE
 requests
   to fail as expected.
 - Issue 2102 - SSH payload length underflow calculation for ETM/ChaChaPoly
   algorithms in mod_sftp.
 - Issue 2104 - SSH packet with empty payload triggers null pointer
 dereference
   in mod_sftp.
 - Issue 2106 - Bad DSA signatures can lead to out-of-bounds read of heap
 memory
   in mod_sftp.
 - Issue 2108 - Mismatched RSA/DSA algorithm signatures can lead to null
   dereference in mod_sftp.
 - Issue 2115 - SFTP request payload length underflow calculation in
 mod_sftp.
 - Issue 2120 - Several modules fail to build using OpenSSL 4.0.
 }}}
 Fixed at 6ee20c37d6. Leaving open for SA.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23412#comment:2>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page