-
Tue Sep 07 2021 Paul Howarth <paul@city-fan.org> - 1.3.5e-11
- Fix memory disclosure to RADIUS servers by mod_radius (#2001690)
https://github.com/proftpd/proftpd/issues/1284
https://github.com/proftpd/proftpd/pull/1285
-
Mon Sep 14 2020 Paul Howarth <paul@city-fan.org> - 1.3.5e-10
- Fix null pointer dereference for invalid SCP command by passing the
correct argument count to getopt(3)
https://github.com/proftpd/proftpd/issues/1043
https://github.com/proftpd/proftpd/pull/1044
https://bugzilla.redhat.com/show_bug.cgi?id=1878869
-
Wed Feb 19 2020 Paul Howarth <paul@city-fan.org> - 1.3.5e-9
- Fix use-after-free vulnerability in memory pools during data transfer
(CVE-2020-9273, https://github.com/proftpd/proftpd/issues/903)
- mod_sftp: When handling the 'keyboard-interactive' authentication mechanism,
as used for (e.g.) PAM, make sure to properly handle DEBUG, IGNORE,
DISCONNECT, and UNIMPLEMENTED messages, per RFC 4253
http://bugs.proftpd.org/show_bug.cgi?id=4385
-
Fri Nov 29 2019 Paul Howarth <paul@city-fan.org> - 1.3.5e-8
- Fix handling of CRL lookups by properly using issuer for lookups, and
guarding against null pointers (GH#858, GH#859, GH#860, GH#861,
CVE-2019-19269, CVE-2019-19270, CVE-2019-19271, CVE-2019-19272)
-
Wed Oct 23 2019 Paul Howarth <paul@city-fan.org> - 1.3.5e-7
- Fix build compatibility with MySQL 8 (#1764401)
https://github.com/proftpd/proftpd/issues/824
https://github.com/proftpd/proftpd/pull/825
-
Sun Oct 20 2019 Paul Howarth <paul@city-fan.org> - 1.3.5e-6
- Fixed pre-authentication remote denial-of-service issue
(CVE-2019-18217, https://github.com/proftpd/proftpd/issues/846)
-
Tue Jul 23 2019 Paul Howarth <paul@city-fan.org> - 1.3.5e-5
- An arbitrary file copy vulnerability in mod_copy in ProFTPD allowed for
remote code execution and information disclosure without authentication
(CVE-2019-12815)
http://bugs.proftpd.org/show_bug.cgi?id=4372
https://github.com/proftpd/proftpd/pull/816
-
Thu Dec 07 2017 Paul Howarth <paul@city-fan.org> - 1.3.5e-4
- Add InsecureHostKeyPerms SFTP option (#1522998, upstream bug 4098)
-
Wed Sep 20 2017 Paul Howarth <paul@city-fan.org> - 1.3.5e-3
- Add sqlite sub-package with mod_sql_sqlite for SQLite support (#1328321)
-
Wed May 03 2017 Paul Howarth <paul@city-fan.org> - 1.3.5e-2
- AllowChrootSymlinks off could cause login failures depending on filesystem
permissions: use the IDs of the logging-in user to perform the directory
walk, looking for symlinks, to be more consistent with similar checks done
during login (#1443507, upstream bug 4306)
- Crypt::CrackLib always available now