OESA-2024-1075

    Dashboard / Vulnerabilities / OESA-2024-1075

    OESA-2024-1075

    Published: 19 Jan 2024Last Modified: 18 Aug 2026
    Upstream:
    CVE-2023-51713

    Summary: proftpd security update

    Details: ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif Security Fix(es): make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.(CVE-2023-51713)

    References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1075, https://nvd.nist.gov/vuln/detail/CVE-2023-51713

    Affected packages

    Package

    Name: proftpd

    Purl: pkg:rpm/openEuler/proftpd&distro=openEuler-20.03-LTS-SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.3.8b-2.oe1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2024-1075 | CVE-DB