Bugzilla – Bug 1154600
VUL-0: CVE-2019-18217: proftpd: remote unauthenticated denial-of-service due to incorrect handling of overly long commands
Last modified: 2020-01-16 12:43:42 UTC
CVE-2019-18217 ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18217 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18217 https://github.com/proftpd/proftpd/blob/master/NEWS https://github.com/proftpd/proftpd/issues/846 https://github.com/proftpd/proftpd/blob/1.3.6/NEWS https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES
fixed with update to 1.3.6b
This is an autogenerated message for OBS integration: This bug (1154600) was mentioned in https://build.opensuse.org/request/show/759945 15.1+Backports:SLE-15+Backports:SLE-15-SP1 / proftpd
openSUSE-SU-2020:0031-1: An update that solves 5 vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1113041,1144056,1154600,1155834,1156210,1157798,1157803 CVE References: CVE-2017-7418,CVE-2019-12815,CVE-2019-18217,CVE-2019-19269,CVE-2019-19270 Sources used: openSUSE Leap 15.1 (src): proftpd-1.3.6b-lp151.3.6.1 openSUSE Backports SLE-15-SP1 (src): proftpd-1.3.6b-bp151.4.6.2 openSUSE Backports SLE-15 (src): proftpd-1.3.6b-bp150.3.6.1
all done. Closing