Skip to contentSkip to conversation

package/proftpd: security bump to version 1.3.6c

PATCH New Peter Korsgaard 2 participants 3 messages Feb 27, 2020 – Mar 14, 2020

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 package/proftpd: security bump to version 1.3.6c

Fixes the following security issues:

- CVE-2020-9273: In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

And additionally, fixes a number of other issues. For details, see the release notes:

https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES

This also bumps the bundled libcap, so 0001-fix-kernel-header-capability-version.patch can be dropped.

While we are at it, adjust the white space in the .hash function to match the new agreements.

Signed-off-by Peter Korsgaard <[email protected]>
---
 .../0001-fix-kernel-header-capability-version.patch  | 12 ------------
 package/proftpd/proftpd.hash                         |  4 ++--
 package/proftpd/proftpd.mk                           |  2 +-
 3 files changed, 3 insertions(+), 15 deletions(-)
 delete mode 100644 package/proftpd/0001-fix-kernel-header-capability-version.patch
package/proftpd/0001-fix-kernel-header-capability-version.patch deleted +0 -12
deleted file mode 100644
index 4401c9aeaf..0000000000
@@ -1,12 +0,0 @@
---- a/lib/libcap/libcap.h	2008-08-22 19:49:48.000000000 -0700
-+++ b/lib/libcap/libcap.h	2010-10-06 15:31:11.000000000 -0700
-@@ -65,7 +65,8 @@ struct _cap_struct {
-  */
- 
- #if !defined(_LINUX_CAPABILITY_VERSION_1) || \
--            (_LINUX_CAPABILITY_VERSION_1 != 0x19980330)
-+            ((_LINUX_CAPABILITY_VERSION_1 != 0x19980330) && \
-+            (_LINUX_CAPABILITY_VERSION_1 != 0x20071026))
- 
- # error "Kernel <linux/capability.h> does not match library"
- # error "file "libcap.h" --> fix and recompile libcap"
package/proftpd/proftpd.hash +2 -2
index 0f2acd3a20..1ac54de4ca 100644
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256 fe5baf6c469a2b0b7f0e2611561b6fd5414300e32a76b96adb2ccfe05b5efb60 proftpd-1.3.6b.tar.gz
-sha256 391a473d755c29b5326fb726326ff3c37e42512f53a8f5789fc310232150bf80 COPYING
+sha256  fa3541c4b34136a7b80cb12a2f6f9a0cab5118a5b0a1653d40af49c6479c35ad  proftpd-1.3.6c.tar.gz
+sha256  391a473d755c29b5326fb726326ff3c37e42512f53a8f5789fc310232150bf80  COPYING
package/proftpd/proftpd.mk +1 -1
index 2c3e0a6877..02dd0e825e 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-PROFTPD_VERSION = 1.3.6b
+PROFTPD_VERSION = 1.3.6c
 PROFTPD_SITE = $(call github,proftpd,proftpd,v$(PROFTPD_VERSION))
 PROFTPD_LICENSE = GPL-2.0+
 PROFTPD_LICENSE_FILES = COPYING
Signature · 1 line
2.20.1
Applied
#1 lore raw

PATCH 1/1 package/proftpd: security bump to version 1.3.6c

Quoted 17 lines · On Thu, 27 Feb 2020 14:54:56 +0100 Peter Korsgaard <[email protected]> wrote:

Fixes the following security issues:

- CVE-2020-9273: In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

And additionally, fixes a number of other issues. For details, see the release notes:

https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES

This also bumps the bundled libcap, so 0001-fix-kernel-header-capability-version.patch can be dropped.

While we are at it, adjust the white space in the .hash function to match the new agreements.

Quoted 7 lines
Signed-off-by Peter Korsgaard <[email protected]>
---
 .../0001-fix-kernel-header-capability-version.patch  | 12 ------------
 package/proftpd/proftpd.hash                         |  4 ++--
 package/proftpd/proftpd.mk                           |  2 +-
 3 files changed, 3 insertions(+), 15 deletions(-)
 delete mode 100644 package/proftpd/0001-fix-kernel-header-capability-version.patch

Applied to master, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
author
#2 lore raw

PATCH 1/1 package/proftpd: security bump to version 1.3.6c

In reply to Peter Korsgaard
Quoted 12 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes the following security issues:
- CVE-2020-9273: In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

And additionally, fixes a number of other issues. For details, see the release notes:

https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES

Quoted 7 lines

This also bumps the bundled libcap, so 0001-fix-kernel-header-capability-version.patch can be dropped.

While we are at it, adjust the white space in the .hash function to match the new agreements.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2019.02.x and 2019.11.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard