This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-19271 →

DEBIAN-CVE-2019-19271

An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL ent...

Original description

The description as published by the source.

An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (installed by a system administrator), can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to proceed with a connection to the server.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 proftpd-dfsg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]

Debian:13 proftpd-dfsg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]

Debian:14 proftpd-dfsg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]

References

advisory security-tracker.debian.org