linux/meta-openembedded.git/meta-networking/recipes-daemons/proftpd, branch master-next

proftpd: upgrade 1.3.9a -> 1.3.9b

2026-06-09T14:26:35+00:00

Changelog: ========== - Issue 2057 - SQL Injection in mod_wrap2_sql via reverse DNS hostname (CVE-2026-44331). - Issue 2056 - Incomplete fix for session management with OpenSSL 3.2.x or later, when using TLSv1.2 or earlier. This complements the fix for Issue #1963. - Issue 2098 - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as expected. - Issue 2102 - SSH payload length underflow calculation for ETM/ChaChaPoly algorithms in mod_sftp. - Issue 2104 - SSH packet with empty payload triggers null pointer dereference in mod_sftp. - Issue 2106 - Bad DSA signatures can lead to out-of-bounds read of heap memory in mod_sftp. - Issue 2108 - Mismatched RSA/DSA algorithm signatures can lead to null dereference in mod_sftp. - Issue 2115 - SFTP request payload length underflow calculation in mod_sftp. - Issue 2120 - Several modules fail to build using OpenSSL 4.0. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

proftpd: upgrade 1.3.9 -> 1.3.9a

2026-05-12T08:06:59+00:00

Security fix: CVE-2026-42167 ChangeLog: https://github.com/proftpd/proftpd/blob/1.3.9/NEWS Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

proftpd: ignore CVE-2021-47865

2026-02-05T04:53:29+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865 This CVE was opened based on a 5 years old Github issue[1], and has been made public recently. The CVE wasn't officially disputed (yet?), but based on the description and the given PoC the application is working as expected. The vulnerability description and the PoC basically configures proftpd to accept maximum x connections, and then when the user tries to open x + 1 concurrent connections, it refuses new connections over the configured limit. See also discussion in the Github issue. It seems that it won't be fixed, because there is nothing to fix. [1]: https://github.com/proftpd/proftpd/issues/1298 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

meta-openembedded/all: adapt to UNPACKDIR changes

2025-06-25T13:44:52+00:00

Please see https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265 for what changes are needed, and sed commands that can be used to make them en masse. I've verified that bitbake -c patch world works with these, but did not run a world build; the majority of recipes shouldn't need further fixups, but if there are some that still fall out, they can be fixed in followups. Signed-off-by: Alexander Kanavin Signed-off-by: Khem Raj

proftpd: upgrade to 1.3.9 to fix build with gcc-15

2025-04-26T17:31:26+00:00

* fixed in: https://github.com/proftpd/proftpd/commit/61be7eb14f200b97804a3cfa85fed51661067c62 Signed-off-by: Martin Jansa Signed-off-by: Khem Raj

proftpd: define suffix for CVE version comparison

2025-01-15T20:04:53+00:00

Similarly to old openssl versions, proftpd has patch releases with characters instead of numbers. Signed-off-by: Peter Marko Signed-off-by: Khem Raj

proftpd: upgrade 1.3.8b -> 1.3.8c

2025-01-15T20:04:53+00:00

See https://github.com/proftpd/proftpd/blob/1.3.8/RELEASE_NOTES Signed-off-by: Peter Marko Signed-off-by: Khem Raj

proftpd: define UPSTREAM_CHECK_GITTAGREGEX

2025-01-15T20:04:53+00:00

Patch releases have character after version devtool upgrade would currently downgrade 1.3.8b -> 1.3.8 This will make it upgrade 1.3.8b -> 1.3.8c Signed-off-by: Peter Marko Signed-off-by: Khem Raj

proftpd: set status of CVE-2001-0027

2024-12-10T21:43:54+00:00

This ancient CVE [1] is unversioned ("*") in NVD DB. "mod_sqlpw module in ProFTPD does not reset a cached password..." Looking at history and changelog, the module was removed [2] around the time when this CVE was published, likely as reaction to this CVE. "mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the distribution. They are currently unmaintained and have numerous bugs." Note: It was later re-introduced as mod_sql when it got fixed under new maintainer. [1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027 [2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362 Signed-off-by: Peter Marko Signed-off-by: Khem Raj

proftpd: Upgrade to 1.3.8b

2024-08-16T06:20:05+00:00

Fix buildpaths QA Errors while here Signed-off-by: Khem Raj