linux/meta-openembedded.git/meta-networking/recipes-daemons/proftpd/proftpd_1.3.7f.bb, branch scarthgapMirror of git.openembedded.org/meta-openembeddedhttps://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=scarthgap2026-02-12T08:08:12+00:00proftpd: ignore CVE-2021-478652026-02-12T08:08:12+00:00Gyorgy Sarvariskandigraun@gmail.com2026-02-07T10:33:49+00:00urn:sha1:d691a39655c535e4a47c8ad0afe6f8c57f65ef5a
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865
This CVE was opened based on a 5 years old Github issue[1], and has been made
public recently. The CVE wasn't officially disputed (yet?), but based on
the description and the given PoC the application is working as expected.
The vulnerability description and the PoC basically configures proftpd to
accept maximum x connections, and then when the user tries to open x + 1
concurrent connections, it refuses new connections over the configured limit.
See also discussion in the Github issue.
It seems that it won't be fixed, because there is nothing to fix.
[1]: https://github.com/proftpd/proftpd/issues/1298
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
proftpd: patch CVE-2024-486512026-01-12T02:22:00+00:00Ankur Tyagiankur.tyagi85@gmail.com2026-01-09T09:28:38+00:00urn:sha1:bfd8dda3ba5e3e0a820e489ed177de6d60ddfa50
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-48651
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
proftpd: Fix CVE-2023-487952025-12-11T02:32:03+00:00Vijay Anusurivanusuri@mvista.com2025-12-10T17:38:37+00:00urn:sha1:b4812b18eec77e9f0286bd6b81a5c3032ac0d3be
Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/bcec15efe6c53dac40420731013f1cd2fd54123b
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
(cherry picked from commit 6c8ae54fc345fb6249f1cc92ed769d451ddc12b5)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
proftpd: set status of CVE-2001-00272025-11-17T06:20:20+00:00Peter Markopeter.marko@siemens.com2025-11-15T18:23:11+00:00urn:sha1:1a6b962e47873171f1c5ef7ba239c1f2a570d6f1
This ancient CVE [1] is unversioned ("*") in NVD DB.
"mod_sqlpw module in ProFTPD does not reset a cached password..."
Looking at history and changelog, the module was removed [2] around
the time when this CVE was published, likely as reaction to this CVE.
"mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the
distribution. They are currently unmaintained and have numerous bugs."
Note: It was later re-introduced as mod_sql when it got fixed under
new maintainer.
[1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027
[2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 03a1b56bc7ce88a3b0ad6790606b0498899cc1e3)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
proftpd: upgrade 1.3.7c -> 1.3.7f2025-11-12T05:44:57+00:00Ankur Tyagiankur.tyagi85@gmail.com2025-11-11T09:37:29+00:00urn:sha1:90fa6fc6e86946474ec901b00e30313f6a40142a
https://github.com/proftpd/proftpd/blob/1.3.7/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>