Fedora 30: proftpd FEDORA-2019-e9187610c3 Critical: Remote Code Execution

ProFTPD is an enhanced FTP server with a focus toward simplicity, security,

and ease of configuration. It features a very Apache-like configuration

syntax, and a highly customizable server infrastructure, including support for

multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory

visibility.

This package defaults to the standalone behavior of ProFTPD, but all the

needed scripts to have it run by systemd instead are included.

This update addresses an arbitrary file copy vulnerability in mod_copy in

ProFTPD, which allowed for remote code execution and information disclosure

without authentication due to not honoring `` constraints. Upstream bug:

http://bugs.proftpd.org/show_bug.cgi?id=4372

* Tue Jul 23 2019 Paul Howarth - 1.3.6-21

- An arbitrary file copy vulnerability in mod_copy in ProFTPD allowed for

remote code execution and information disclosure without authentication

(CVE-2019-12815)

http://bugs.proftpd.org/show_bug.cgi?id=4372

https://github.com/proftpd/proftpd/pull/816

[ 1 ] Bug #1732365 - CVE-2019-12815 proftpd: file copy vulnerability in mod_copy allows for remote code execution

https://bugzilla.redhat.com/show_bug.cgi?id=1732365

su -c 'dnf upgrade --advisory FEDORA-2019-e9187610c3' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/