ELBA-2026-601027
- ULN >
- Oracle Linux Errata repository >
- ELBA-2026-601027
ELBA-2026-601027 - proftpd Bug Fix update
| Type: | BUG |
| Impact: | NA |
| Release Date: | 2026-08-06 |
Description
[1.3.8d-4]
- Address another avenue for SQL injection, via custom SQLUserInfo queries
(https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598)
- Fix SFTP request payload length underflow calculation in mod_sftp
(CVE-2026-53994, https://github.com/proftpd/proftpd/issues/2115)
- Exercise caution when reading the client-provided file size for SCP uploads,
as it could possibly overflow our size type (CVE-2026-63091)
- Authenticated SFTP sessions could overflow the SFTP packet buffer
(CVE-2026-63090, https://github.com/proftpd/proftpd/issues/2190)
- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
/proc/self/root path prefix); this module disallows file accesses via procfs
filesystems
Updated Packages
| Release/Architecture | Filename | sha256 | Superseded By Advisory | Channel Label |
| Oracle Linux 9 (x86_64) | proftpd-1.3.8d-4.el9.src.rpm | eed571f89461ae83273c62dd969fdc4a9d3b45a837773580cb82ea61e4eb2e66 | - | ol9_x86_64_developer_EPEL |
| proftpd-1.3.8d-4.el9.x86_64.rpm | 872222cf1a1e08ee6d97425b9f3ebcdc0acbc9892319ef1174ad82a23529b813 | - | ol9_x86_64_developer_EPEL | |
| proftpd-devel-1.3.8d-4.el9.x86_64.rpm | d51a5df5fcfe1b05457ff1934ca858ba8d6d8713e28422b1900be04b27098745 | - | ol9_x86_64_developer_EPEL | |
| proftpd-ldap-1.3.8d-4.el9.x86_64.rpm | 47fa31ddc05e74e4b6a380db6323a5280be64d5f6f7c188a6fcab9a1a601fccb | - | ol9_x86_64_developer_EPEL | |
| proftpd-mysql-1.3.8d-4.el9.x86_64.rpm | bb1ff8866b453ad1530463bd43a21b04c6f7abaafe449eb0ba92bf0719f97622 | - | ol9_x86_64_developer_EPEL | |
| proftpd-postgresql-1.3.8d-4.el9.x86_64.rpm | 19999486c52f59a54f85cf7d3d63de460e94b217546b297fdc2b77fec74b96bb | - | ol9_x86_64_developer_EPEL | |
| proftpd-proxy-1.3.8d-4.el9.x86_64.rpm | 210db1d3cd4e2edaa0c5178c91b9dd0d48ec94873a6ab69cb66a10684b4969aa | - | ol9_x86_64_developer_EPEL | |
| proftpd-sqlite-1.3.8d-4.el9.x86_64.rpm | 39ee0e4651a7831f2f703cf8c674705d83e2921f13b2352e54c84c1db22ad2e3 | - | ol9_x86_64_developer_EPEL | |
| proftpd-utils-1.3.8d-4.el9.x86_64.rpm | 315af992c0b7520f0b87d06ce3eb5a57ba12c9bbf2e7add0cbdc56fb33f47166 | - | ol9_x86_64_developer_EPEL | |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
