Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2019-19271 →

DEBIAN-CVE-2019-19271

An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL ent...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (installed by a system administrator), can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to proceed with a connection to the server.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 proftpd-dfsg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]

Debian:13 proftpd-dfsg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]

Debian:14 proftpd-dfsg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]

Références

advisory security-tracker.debian.org