ELBA-2025-32959

ELBA-2025-32959 - proftpd Bug Fix update

Type:	BUG
Impact:	NA
Release Date:	2025-03-28

Description

[1.3.8d-1]
- Update to 1.3.8d
- Use of HideNoAccess for SFTP sessions can lead to segfault and/or
unexpected behaviour (GH#1855)
- SFTP channel allocations can lead to high memory utilization over time
(GH#1876)
- Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)

[1.3.8c-2]
- Avoid NULL pointer dereferences in mod_ls (CVE-2024-57392)
- https://github.com/proftpd/proftpd/issues/1866

[1.3.8c-1]
- Update to 1.3.8c
- Using FTPS after upgrading from 1.3.8a to 1.3.8b lead to crash (GH#1770)
- Bad handling of lack of extended attributes lead to SFTP out of memory
error (GH#1785)
- mod_sftp_sql logged 'header value too long' due to unexpected key header
text (GH#1529)
- SSH ECDSA host key algorithms were not used as expected despite configuring
appropriate key (GH#1839)
- RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
(GH#1840)
- Supplemental group inheritance granted unintended access to GID 0 due to
lack of supplemental groups from mod_sql (GH#1830)

[1.3.8b-4]
- Fix RADIUS Message-Authenticator verification in mod_radius
- https://github.com/proftpd/proftpd/issues/1840
- https://bugzilla.redhat.com/show_bug.cgi?id=2325448

[1.3.8b-3]
- Add 'proxy' sub-package with unbundled mod_proxy (rhbz#2272051)
- Update fsio.c: if mkdir fails with EEXIST, also clear the cache (GH#1677)

[1.3.8b-2]
- Use libsodium to provide ed25519 key support for mod_sftp (#2256340)
- Update logrotate snippet to use try-reload-or-restart rather than reload
for distributions with systemd 229 or later (PR#3)

[1.3.8b-1]
- Update to 1.3.8b
- Compiling ProFTPD 1.3.8a mod_sftp, mod_tls using libressl 3.7.3 failed
(GH#1735)
- Build system failed for specific module names (GH#1756)
- 'Terrapin' Prefix Truncation Attacks in SSH Specification affected mod_sftp
(CVE-2023-48795, GH#1760)

[1.3.8a-1]
- Update to 1.3.8a
- Fix mod_sftp failure to handle SFTP requests to truncate files to zero size
(GH#1581)
- Fix mod_sftp improperly handling SFTP WRITE requests for files opened for
appending (GH#1584)
- Build-time detection of Linux POSIX ACL support was broken since 1.3.8rc2
(GH#1568)
- Fix failure to load mod_rewrite as a dynamic module due to
incomplete/missing library linker flags (GH#1590)
- section is allowed to be in , but From directive is not
(GH#1597)
- ExtendedLog SSH, SFTP classes not working as expected (GH#1617)
- Fix mod_sftp not handling multiple concurrent open file handles/transfers
well for logging (GH#1646)
- 'TLSRequired off' plus Protocols directive caused mod_tls to terminate the
session abruptly (GH#1679)
- Fix mod_tls failure to compile against OpenSSL 3.0.8 due to missing
ENGINE_METHOD_ flags (GH#1689)
- Unknown named connection error when using different SQL backends (GH#1659)
- Fix mod_sql not properly closing all named backend connections on session
exit (GH#1697)
- SSH key exchanges failed unexpectedly with 'unable to write X bytes of raw
data' errors due to small ProFTPD buffer (GH#1694)
- Fix high session memory usage caused by SFTP outgoing data buffering
(GH#1678)
- Out-of-bounds buffer read when handling FTP commands (GH#1683,
CVE-2023-51713)
- SFTP algorithm settings in section were not being used (GH#1712)

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (x86_64)	proftpd-1.3.8d-1.el9.src.rpm	d85ce99d2dfde9d7e629a6c4dcc02987bba83507a0792fe1573afcb0a24ded37	-	ol9_x86_64_developer_EPEL
	proftpd-1.3.8d-1.el9.x86_64.rpm	fbbcd36e3bd9cc07e7c87ffd5c733f7516c5c7816d8fd4d68c5aa65284e1ff60	-	ol9_x86_64_developer_EPEL
	proftpd-devel-1.3.8d-1.el9.x86_64.rpm	9ab9a783dc660e5cc9d61da06e0e7872c4f04dd635c5350e30e7252a77ef545b	-	ol9_x86_64_developer_EPEL
	proftpd-ldap-1.3.8d-1.el9.x86_64.rpm	9e326d4bbf975f8e74f2f0e0bd55b3f2c5cd4bc909e5de7ebc74af8f77e7c215	-	ol9_x86_64_developer_EPEL
	proftpd-mysql-1.3.8d-1.el9.x86_64.rpm	cd883091cb6694eb8a4b3da32d0ddec8155a4360c86bcb626a6c2db78b9ddbc0	-	ol9_x86_64_developer_EPEL
	proftpd-postgresql-1.3.8d-1.el9.x86_64.rpm	757ea2c47f18c23438f93c6d15ab705918ac095a94af886d2bcc89388c0aba8e	-	ol9_x86_64_developer_EPEL
	proftpd-proxy-1.3.8d-1.el9.x86_64.rpm	44be1f6382139cf711782bc8d382a828a28ff64f037888d0a1f2fc205d308d66	-	ol9_x86_64_developer_EPEL
	proftpd-sqlite-1.3.8d-1.el9.x86_64.rpm	0361a232b561c4d2588fcead374d9fe7cf0741eac90feaac3fe92456aaa6618d	-	ol9_x86_64_developer_EPEL
	proftpd-utils-1.3.8d-1.el9.x86_64.rpm	bdd99206ec146b9c3bd61efafcca29ab14962b75bb55a3666510934258137aeb	-	ol9_x86_64_developer_EPEL

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team