Fedora Packages

proftpd-sqlite-1.3.9e-3.fc46 in Fedora Rawhide

↵ Return to the main page of proftpd-sqlite
View build
Search for updates

Package Info (Data from x86_64 build)
🠗 Changelog
🠗 Dependencies
🠗 Provides
🠗 Files

Changelog

Date Author Change
2026-11-05 Paul Howarth <paul at city dash fan dot org> - 1.3.9e-3 - Fix some issues in mod_copy (not enabled by default) - <Limit READ> configurations were not honored by SITE COPY as they should be (GH#2095) - Fix write restriction bypass via symlink following in mod_copy (GH#2374, CVE-2026-119364)
2026-10-28 Paul Howarth <paul at city dash fan dot org> - 1.3.9e-2 - Fix regression in the handling of private keys formatted using the OpenSSH-specific private key format, and which are not passphrase-protected (GH#2411)
2026-10-27 Paul Howarth <paul at city dash fan dot org> - 1.3.9e-1 - Update to 1.3.9e - Insufficient validation of FTP RANG, REST parameters could lead to use of negative file offsets (GH#2286) - Regression with custom user/group info SQLNamedQuery in 1.3.9d (GH#2293) - Unauthenticated SNMP UDP packets kill SNMP agent due to underflow computation (GH#2301) - Stale password-less authentication flag in mod_auth could allow wrong passwords to authenticate (GH#2319) - Stack overflow possible via long PASS text in mod_radius module (GH#2330) - Error out if configured for SSL/TLS Redis usage, but hiredis library lacks SSL/TLS support (GH#2344) - Support using Huffman encoding only for SSH channel compression (GH#2366) - FTP TLSv1.3 uploads may fail with ECONNRESET if client does not provide session ticket for data transfer (GH#2367) - Selection of median delay value leads to out-of-bounds read on first login (GH#2380) - mod_radius does not verify that UDP packets are received from the same address to which UDP packets are sent (GH#2384) - mod_ban SysV shared memory segment default permissions allow for local unprivileged user read/write access (GH#2388) - Guard against overly-long keys overflowing buffers when the "utf8trans" builtin RewriteMap type is used (CVE-2026-119146) - Fix authorization bypass via mod_sftp copy-file extension (CVE-2026-119147)
2026-08-24 Paul Howarth <paul at city dash fan dot org> - 1.3.9d-2 - Fix regression in mod_sql's SQLNamedQuery (upstream bug 4515, GH#2293)
2026-08-18 Paul Howarth <paul at city dash fan dot org> - 1.3.9d-1 - Update to 1.3.9d - SSH channel open request from authenticated client with max packet size of zero lead to infinite loop (GH#2242) - Aborted/failed data transfers incorrectly clear any "EPSV ALL" state (GH#2255) - Possible use-after-free issue via FTP STAT command using -C option; note that the -C option is now silently ignored for FTP STAT commands (GH#2265) - Passive FTP data transfers do not honor AllowForeignAddress policy properly (GH#2272) - Empty password fields should be rejected by the mod_sql_passwd module (GH#2275) - Empty password fields should be rejected by the mod_auth_file module (GH#2279) - .ftpaccess file policy bypass possible in certain configurations (GH#2282)
2026-08-04 Paul Howarth <paul at city dash fan dot org> - 1.3.9c-4 - Update mod_procfs to 0.3 - Also block access to sysfs filesystems
2026-07-21 Paul Howarth <paul at city dash fan dot org> - 1.3.9c-3 - Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via /proc/self/root path prefix); this module disallows file accesses via procfs filesystems
2026-07-16 Fedora Release Engineering <releng at fedoraproject dot org> - 1.3.9c-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
2026-07-08 Paul Howarth <paul at city dash fan dot org> - 1.3.9c-1 - Update to 1.3.9c - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135) - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146) - MaxTransfersPerUser no longer enforces configured limits (GH#2158) - AdminControlsACLs for config, get actions not honored as they should be (GH#2163) - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed buffers without bounds checking (GH#2166) - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails to reject illegal characters (GH#2173) - SQL group name lookup concatenates client-provided group names without escaping (GH#2188) - Authenticated SFTP sessions can overflow the SFTP packet buffer (GH#2190, CVE-2026-63090) - Default Controls socket ACLs unintentionally allow all users access for sending Controls requests (GH#2210) - Exercise caution when reading the client-provided file size for SCP uploads, as it could possibly overflow our size type (CVE-2026-63091)
2026-06-12 Yaakov Selkowitz <yselkowi at redhat dot com> - 1.3.9b-2 - Rebuilt for openssl 4.0

Dependencies

Provides

  • proftpd-sqlite
  • proftpd-sqlite(x86-64)

Files


Sources on Pagure