linux/meta-openembedded.git/meta-networking/recipes-daemons/proftpd, branch kirkstone

proftpd: ignore CVE-2021-47865

2026-01-30T17:59:29+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865 This CVE was opened based on a 5 years old Github issue[1], and has been made public recently. The CVE wasn't officially disputed (yet?), but based on the description and the given PoC the application is working as expected. The vulnerability description and the PoC basically configures proftpd to accept maximum x connections, and then when the user tries to open x + 1 concurrent connections, it refuses new connections over the configured limit. See also discussion in the Github issue. I just put it on the ignore list. [1]: https://github.com/proftpd/proftpd/issues/1298 Signed-off-by: Gyorgy Sarvari

proftpd: set status of CVE-2001-0027

2026-01-08T21:03:03+00:00

This ancient CVE [1] is unversioned ("*") in NVD DB. "mod_sqlpw module in ProFTPD does not reset a cached password..." Looking at history and changelog, the module was removed [2] around the time when this CVE was published, likely as reaction to this CVE. "mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the distribution. They are currently unmaintained and have numerous bugs." Note: It was later re-introduced as mod_sql when it got fixed under new maintainer. [1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027 [2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362 Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 03a1b56bc7ce88a3b0ad6790606b0498899cc1e3) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari

proftpd: patch CVE-2024-48651

2025-12-17T14:38:00+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-48651 Backport the patch mentioned in the NVD report. Signed-off-by: Gyorgy Sarvari

proftpd: Fix CVE-2023-48795

2025-10-20T09:59:36+00:00

Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/bcec15efe6c53dac40420731013f1cd2fd54123b Signed-off-by: Vijay Anusuri Signed-off-by: Gyorgy Sarvari

proftpd: Fix CVE-2024-57392

2025-07-03T00:30:13+00:00

Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/981a37916fdb7b73435c6d5cdb01428b2269427d Signed-off-by: Vijay Anusuri Signed-off-by: Armin Kuster

proftpd: Fix CVE-2023-51713 Out-of-bounds buffer read

2024-01-12T12:14:16+00:00

Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/97bbe68363ccf2de0c07f67170ec64a8b4d62592 Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster

proftpd: update to 1.3.7c

2022-03-07T17:27:53+00:00

Signed-off-by: Radovan Scasny Signed-off-by: Khem Raj

recipes: Update LICENSE variable to use SPDX license identifiers

2022-03-05T01:41:45+00:00

Signed-off-by: Khem Raj

recipes: Update SRC_URI branch and protocols

2021-11-03T13:57:49+00:00

This patch updates SRC_URIs using git to include branch=master if no branch is set and also to use protocol=https for github urls as generated by the conversion script in OE-Core. Signed-off-by: Richard Purdie Signed-off-by: Khem Raj

Convert to new override syntax

2021-08-03T17:21:25+00:00

This is the result of automated script (0.9.1) conversion: oe-core/scripts/contrib/convert-overrides.py . converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Martin Jansa