CVSS: 4.9EPSS: 0%CPEs: 11EXPL: 0CVE-2019-19269
https://notcve.org/view.php?id=CVE-2019-19269
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup. Se detectó un problema en tls_verify_crl en ProFTPD versiones hasta 1.3.6b. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html https://github.com/proftpd/proftpd/issues/861 https://lists.debian.org/debian-lts-announce/2019/11/msg00039.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGBBCPLJSDPFG5EI5P5G7P4KEX7YSD5G https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QR65XUHPCRU3NXTSFVF2J4GWRIHC7AHW https://security.gentoo.org/glsa/202003-35 https://www.oracle.com/security-alerts/cpu • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-19270
https://notcve.org/view.php?id=CVE-2019-19270
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server. Se detectó un problema en la función tls_verify_crl en ProFTPD versiones hasta 1.3.6b. Un fallo en la comprobación del campo apropiado de una entrada de CRL (verificando dos veces por tema, en lugar de una vez por tema y una vez por emisor), impide tener en cuenta algunas CRL válidas y puede permitir que clientes cuyos certificados han sido revocados continúen con una conexión en el servidor. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html https://github.com/proftpd/proftpd/issues/859 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGBBCPLJSDPFG5EI5P5G7P4KEX7YSD5G https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QR65XUHPCRU3NXTSFVF2J4GWRIHC7AHW • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19271
https://notcve.org/view.php?id=CVE-2019-19271
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (installed by a system administrator), can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to proceed with a connection to the server. Se detectó un problema en la función tls_verify_crl en ProFTPD versiones anteriores a 1.3.6. Una variable de iteración errónea, utilizada cuando se comprueba un certificado de cliente contra las entradas de CRL (instaladas por un administrador del sistema), puede causar que se ignoren algunas entradas de CRL y puede permitir que clientes cuyos certificados han sido revocados continúen con una conexión en el servidor. • https://github.com/proftpd/proftpd/issues/860 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19272
https://notcve.org/view.php?id=CVE-2019-19272
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. Direct dereference of a NULL pointer (a variable initialized to NULL) leads to a crash when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup. Se detectó un problema en la función tls_verify_crl en ProFTPD versiones anteriores a 1.3.6. Una desreferencia directa de un puntero NULL (una variable inicializada en NULL) conlleva a un bloqueo al comprobar el certificado de un cliente que se conecta al servidor en una configuración de autenticación mutua cliente/servidor TLS. • https://github.com/proftpd/proftpd/issues/858 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 94%CPEs: 8EXPL: 1CVE-2019-18217
https://notcve.org/view.php?id=CVE-2019-18217
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop. ProFTPD versiones anteriores a 1.3.6b y versiones 1.3.7rc anteriores a 1.3.7rc2, permite una denegación de servicio remota no autenticada debido al manejo incorrecto de comandos demasiado largos porque el archivo main.c en un proceso secundario entra en un bucle infinito. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf https://github.com/proftpd/proftpd/blob/1.3.6/NEWS https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES https://github.com/proftpd/proftpd/blob/master/NEWS https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES https://github.com/proftpd/proftpd/issues/846 https://lists.debian.org/debian-lts-announce/2019/10/msg00036.html htt • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •