-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4491-1 security@xxxxxxxxxx https://www.debian.org/security/ Moritz Muehlenhoff August 04, 2019 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : proftpd-dfsg CVE ID : CVE-2019-12815 Debian Bug : 932453 Tobias Maedel discovered that the mod_copy module of ProFTPD, a FTP/SFTP/FTPS server, performed incomplete permission validation for the CPFR/CPTO commands. For the oldstable distribution (stretch), this problem has been fixed in version 1.3.5b-4+deb9u1. For the stable distribution (buster), this problem has been fixed in version 1.3.6-4+deb10u1. We recommend that you upgrade your proftpd-dfsg packages. For the detailed security status of proftpd-dfsg please refer to its security tracker page at: https://security-tracker.debian.org/tracker/proftpd-dfsg Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl1HJp8ACgkQEMKTtsN8 Tja0yA/+Nq7AaIPVTNqL/9QWf8dSeK3S3YhIuk48CJtq9mRv1qhXFalkN2N3IfNW YCm0cQsg7d9gKgkJVD92AzBuwLtU4Eh1GMYaICg5j73YzYZrkD1e82YmmMQiGCkt cHRSb1ozUC6xIhv2FBhCG/Sr0bKPSptse2uNSWtiZzNxnKEM3HyFB2pNtdhH0NVG BgCRdK5ch3cKMwapbEarG/5EENo2YQS0L03maAbj2SZ2NJVBT6NHyjpznOgHC6Md GKlhCObyKKV9VkxNqlSToFM//HOsVPUvCRmwzzjfmNaH9U5mjjDnMLzx29BsV1P5 ReSVOe1PzKPyPCDg/2K/hLnX9ltgAE4TZcLobxP0aZXZfhtmw1O3I8F4q2zVL6EA tNWLVeTzB6WaUkkqNhBtsNls1sif8iAPMVyxKosS/vl/U+0xvcoFrLxCk1qCupZm eTz5fxeNPWPjUbTlKCSP9U4ci82yBsV5VJ05V8bEWQQ4blH1+CJvYsZQa1khRtvy Bw75z48R9zCTQCT1UrNMFrc9ke2v77P1AoDq7pFNas/uKWLMg+19qXVZzguAwhVZ 14i5Fyb07UpUjM/5wnpeVfkB8ZOs4CUU4c1v2ZvtsLyfidIpp+5tp83Y4I37cgU+ HiJQ6aPu/SzNyv1kKsewVEMgmeu9YI5XTiOL9j4vuufhAGw9fFc= =PRem -----END PGP SIGNATURE-----
