Upstream information

CVE-2019-19269 at MITRE

Description

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 4
Vector AV:N/AC:L/Au:S/C:N/I:N/A:P
Access Vector Network
Access Complexity Low
Authentication Single
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
CVSS v3 Scores
  National Vulnerability Database
Base Score 4.9
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1157803 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP1
  • proftpd >= 1.3.6b-bp151.4.6.2
  • proftpd-devel >= 1.3.6b-bp151.4.6.2
  • proftpd-doc >= 1.3.6b-bp151.4.6.2
  • proftpd-lang >= 1.3.6b-bp151.4.6.2
  • proftpd-ldap >= 1.3.6b-bp151.4.6.2
  • proftpd-mysql >= 1.3.6b-bp151.4.6.2
  • proftpd-pgsql >= 1.3.6b-bp151.4.6.2
  • proftpd-radius >= 1.3.6b-bp151.4.6.2
  • proftpd-sqlite >= 1.3.6b-bp151.4.6.2
 Patchnames:
openSUSE-2020-31
SUSE Package Hub 15
  • proftpd >= 1.3.6b-bp150.3.6.1
  • proftpd-devel >= 1.3.6b-bp150.3.6.1
  • proftpd-doc >= 1.3.6b-bp150.3.6.1
  • proftpd-lang >= 1.3.6b-bp150.3.6.1
  • proftpd-ldap >= 1.3.6b-bp150.3.6.1
  • proftpd-mysql >= 1.3.6b-bp150.3.6.1
  • proftpd-pgsql >= 1.3.6b-bp150.3.6.1
  • proftpd-radius >= 1.3.6b-bp150.3.6.1
  • proftpd-sqlite >= 1.3.6b-bp150.3.6.1
 Patchnames:
openSUSE-2020-31
openSUSE Leap 15.1
  • proftpd >= 1.3.6b-lp151.3.6.1
  • proftpd-devel >= 1.3.6b-lp151.3.6.1
  • proftpd-doc >= 1.3.6b-lp151.3.6.1
  • proftpd-lang >= 1.3.6b-lp151.3.6.1
  • proftpd-ldap >= 1.3.6b-lp151.3.6.1
  • proftpd-mysql >= 1.3.6b-lp151.3.6.1
  • proftpd-pgsql >= 1.3.6b-lp151.3.6.1
  • proftpd-radius >= 1.3.6b-lp151.3.6.1
  • proftpd-sqlite >= 1.3.6b-lp151.3.6.1
 Patchnames:
openSUSE-2020-31
openSUSE Tumbleweed
  • proftpd >= 1.3.6e-1.10
  • proftpd-devel >= 1.3.6e-1.10
  • proftpd-doc >= 1.3.6e-1.10
  • proftpd-lang >= 1.3.6e-1.10
  • proftpd-ldap >= 1.3.6e-1.10
  • proftpd-mysql >= 1.3.6e-1.10
  • proftpd-pgsql >= 1.3.6e-1.10
  • proftpd-radius >= 1.3.6e-1.10
  • proftpd-sqlite >= 1.3.6e-1.10
 Patchnames:
openSUSE Tumbleweed GA proftpd-1.3.6e-1.10

SUSE Timeline for this CVE

CVE page created: Tue Nov 26 15:04:58 2019
CVE page last modified: Thu Dec 7 13:26:48 2023