--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:proftpd-dfsg
User: [email protected]
Usertags: pu
(Please provide enough information to help the release team
to judge the request efficiently. E.g. by filling in the
sections below.)
[ Reason ]
There were a few security leaks recently discovered in the proftp
code. This update addresses these leaks (see below in [Changes]).
[ Impact ]
If the update is not approved, the existing proftp installations
will further suffer from the security leaks in question.
[ Tests ]
The proftp package has an automated test suite, which runs successful
even after applying the pataches.
[ Risks ]
See tests.
[ Checklist ]
[X] *all* changes are documented in the d/changelog
[X] I reviewed all changes and I approve them
[X] attach debdiff against the package in stable
[X] the issue is verified as fixed in unstable
[ Changes ]
The update contains the 4 patches to address CVE-2026-44331 /
CVE-2026-53994 / CVE-2026-63091 / CVE-2026-63090
[ Other info ]
N/A.
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/changelog proftpd-dfsg-1.3.8.c+dfsg/debian/changelog
--- proftpd-dfsg-1.3.8.c+dfsg/debian/changelog 2026-05-01 12:48:15.000000000 +0200
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/changelog 2026-07-22 22:58:45.000000000 +0200
@@ -1,3 +1,12 @@
+proftpd-dfsg (1.3.8.c+dfsg-4+deb13u3) trixie; urgency=medium
+
+ * Add patch for CVE-2026-44331 (Closes: #1135840).
+ * Add patch for CVE-2026-53994.
+ * Add patch for CVE-2026-63091.
+ * Add patch for CVE-2026-63090.
+
+ -- Hilmar Preuße <[email protected]> Wed, 22 Jul 2026 22:58:45 +0200
+
proftpd-dfsg (1.3.8.c+dfsg-4+deb13u2) trixie; urgency=medium
* Add patch for CVE-2026-42167 (Closes: #1135119).
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/gitlab-ci.yml proftpd-dfsg-1.3.8.c+dfsg/debian/gitlab-ci.yml
--- proftpd-dfsg-1.3.8.c+dfsg/debian/gitlab-ci.yml 2026-05-01 12:47:52.000000000 +0200
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/gitlab-ci.yml 2026-07-22 22:58:45.000000000 +0200
@@ -7,9 +7,11 @@
variables:
SALSA_CI_DISABLE_APTLY: 0
SALSA_CI_DISABLE_AUTOPKGTEST: 1
+ SALSA_CI_DISABLE_DEBREBUILD: 1
SALSA_CI_DISABLE_BLHC: 1
SALSA_CI_DISABLE_LINTIAN: 0
SALSA_CI_DISABLE_PIUPARTS: 0
SALSA_CI_DISABLE_REPROTEST: 1
SALSA_CI_DISABLE_BUILD_PACKAGE_ALL: 0
- SALSA_CI_DISABLE_BUILD_PACKAGE_ANY: 0
\ No newline at end of file
+ SALSA_CI_DISABLE_BUILD_PACKAGE_ANY: 0
+ SALSA_CI_DISABLE_USCAN: 1
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/07797aba88dca902da7eaf1dfe262c8896943de7.diff proftpd-dfsg-1.3.8.c+dfsg/debian/patches/07797aba88dca902da7eaf1dfe262c8896943de7.diff
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/07797aba88dca902da7eaf1dfe262c8896943de7.diff 1970-01-01 01:00:00.000000000 +0100
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/07797aba88dca902da7eaf1dfe262c8896943de7.diff 2026-05-23 10:50:34.000000000 +0200
@@ -0,0 +1,103 @@
+From 07797aba88dca902da7eaf1dfe262c8896943de7 Mon Sep 17 00:00:00 2001
+From: TJ Saunders <[email protected]>
+Date: Tue, 5 May 2026 09:56:33 -0700
+Subject: [PATCH] Issue #2057: Properly escape the "name" provided when doing
+ SQL lookups for allowed/denied client IP addresses or DNS names.
+
+---
+ contrib/mod_wrap2_sql.c | 49 +++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 45 insertions(+), 4 deletions(-)
+
+diff --git a/contrib/mod_wrap2_sql.c b/contrib/mod_wrap2_sql.c
+index eaf6ea7dc5..d4fd56e699 100644
+--- a/contrib/mod_wrap2_sql.c
++++ b/contrib/mod_wrap2_sql.c
+@@ -1,7 +1,7 @@
+ /*
+ * ProFTPD: mod_wrap2_sql -- a mod_wrap2 sub-module for supplying IP-based
+ * access control data via SQL tables
+- * Copyright (c) 2002-2016 TJ Saunders
++ * Copyright (c) 2002-2026 TJ Saunders
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+@@ -25,7 +25,7 @@
+ #include "mod_wrap2.h"
+ #include "mod_sql.h"
+
+-#define MOD_WRAP2_SQL_VERSION "mod_wrap2_sql/1.0"
++#define MOD_WRAP2_SQL_VERSION "mod_wrap2_sql/1.1"
+
+ #define WRAP2_SQL_NSLOTS 2
+ #define WRAP2_SQL_CLIENT_QUERY_IDX 0
+@@ -62,6 +62,41 @@ static int sqltab_close_cb(wrap2_table_t *sqltab) {
+ return 0;
+ }
+
++static char *sqltab_get_escaped_text(pool *p, wrap2_table_t *sqltab,
++ const char *text) {
++ pool *tmp_pool = NULL;
++ cmdtable *sql_cmdtab = NULL;
++ cmd_rec *sql_cmd = NULL;
++ modret_t *sql_res = NULL;
++
++ /* Find the cmdtable for the sql_escapestr command, as the provided
++ * name needs to be properly escaped for SQL syntax; see Issue #2057.
++ */
++ sql_cmdtab = pr_stash_get_symbol2(PR_SYM_HOOK, "sql_escapestr", NULL, NULL,
++ NULL);
++ if (sql_cmdtab == NULL) {
++ wrap2_log("error: unable to find SQL hook symbol 'sql_escapestr': "
++ "perhaps your proftpd.conf needs 'LoadModule mod_sql.c'?");
++ return NULL;
++ }
++
++ sql_cmd = sql_cmd_create(tmp_pool, 1, text);
++ sql_res = pr_module_call(sql_cmdtab->m, sql_cmdtab->handler, sql_cmd);
++ if (sql_res == NULL) {
++ wrap2_log("sql_escapestr '%s' returned no data; "
++ "see the mod_sql.c SQLLogFile for more details", text);
++ return NULL;
++ }
++
++ if (MODRET_ISERROR(sql_res)) {
++ wrap2_log("error processing sql_escapestr '%s': "
++ "check the mod_sql.c SQLLogFile for more details", text);
++ return NULL;
++ }
++
++ return sql_res->data;
++}
++
+ static array_header *sqltab_fetch_clients_cb(wrap2_table_t *sqltab,
+ const char *name) {
+ register unsigned int i;
+@@ -70,12 +105,18 @@ static array_header *sqltab_fetch_clients_cb(wrap2_table_t *sqltab,
+ cmd_rec *sql_cmd = NULL;
+ modret_t *sql_res = NULL;
+ array_header *sql_data = NULL;
+- char *query = NULL, **vals = NULL;
++ char *escaped_name = NULL, *query = NULL, **vals = NULL;
+ array_header *clients_list = NULL;
+
+ /* Allocate a temporary pool for the duration of this read. */
+ tmp_pool = make_sub_pool(sqltab->tab_pool);
+
++ escaped_name = sqltab_get_escaped_text(tmp_pool, sqltab, name);
++ if (escaped_name == NULL) {
++ destroy_pool(tmp_pool);
++ return NULL;
++ }
++
+ query = ((char **) sqltab->tab_data)[WRAP2_SQL_CLIENT_QUERY_IDX];
+
+ /* Find the cmdtable for the sql_lookup command. */
+@@ -89,7 +130,7 @@ static array_header *sqltab_fetch_clients_cb(wrap2_table_t *sqltab,
+ }
+
+ /* Prepare the SELECT query. */
+- sql_cmd = sql_cmd_create(tmp_pool, 3, "sql_lookup", query, name);
++ sql_cmd = sql_cmd_create(tmp_pool, 3, "sql_lookup", query, escaped_name);
+
+ /* Call the handler. */
+ sql_res = pr_module_call(sql_cmdtab->m, sql_cmdtab->handler, sql_cmd);
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/baf4b7929758c72cdb6cf16325fa25f435d23db6.diff proftpd-dfsg-1.3.8.c+dfsg/debian/patches/baf4b7929758c72cdb6cf16325fa25f435d23db6.diff
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/baf4b7929758c72cdb6cf16325fa25f435d23db6.diff 1970-01-01 01:00:00.000000000 +0100
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/baf4b7929758c72cdb6cf16325fa25f435d23db6.diff 2026-07-22 22:58:45.000000000 +0200
@@ -0,0 +1,49 @@
+From baf4b7929758c72cdb6cf16325fa25f435d23db6 Mon Sep 17 00:00:00 2001
+From: TJ Saunders <[email protected]>
+Date: Wed, 1 Jul 2026 09:14:38 -0700
+Subject: [PATCH] Exercise caution when reading the client-provided file size
+ for SCP uploads, as it could possibly overflow our size type.
+
+Thanks to Fabian Wahle of Hap Security for reporting this issue.
+---
+ contrib/mod_sftp/scp.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/contrib/mod_sftp/scp.c b/contrib/mod_sftp/scp.c
+index 8c105587f..b1f3e89ae 100644
+--- a/contrib/mod_sftp/scp.c
++++ b/contrib/mod_sftp/scp.c
+@@ -603,16 +603,27 @@ static int recv_perms(pool *p, uint32_t channel_id, char *mode_str,
+
+ static int recv_filesz(pool *p, uint32_t channel_id, char *size_str,
+ off_t *filesz) {
+- register unsigned int i;
++ char *endp = NULL;
++ unsigned long long sz;
++ *filesz = 0;
+
+- /* The file size field could be of arbitrary length. */
+- for (i = 0, *filesz = 0; PR_ISDIGIT(size_str[i]); i++) {
+- pr_signals_handle();
++#if defined(HAVE_STROULL)
++ sz = strtoull(size_str, &endp, 10);
++#else
++ sz = strtoul(size_str, &endp, 10);
++#endif /* HAVE_STROULL */
+
+- *filesz = (*filesz * 10) + (size_str[i] - '0');
++ *filesz = (off_t) sz;
++
++ /* Watch for cases where the sent file size might overflow our size type. */
++ if (*filesz < 0) {
++ pr_trace_msg(trace_channel, 2, "file size out of range");
++ write_confirm(p, channel_id, 1, "file size out of range");
++ return -1;
+ }
+
+- if (size_str[i] != ' ') {
++ if (endp == NULL ||
++ *endp != ' ') {
+ pr_trace_msg(trace_channel, 2, "file size not followed by space delimiter");
+ write_confirm(p, channel_id, 1, "file size not delimited");
+ return -1;
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2115.diff proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2115.diff
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2115.diff 1970-01-01 01:00:00.000000000 +0100
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2115.diff 2026-07-22 22:58:45.000000000 +0200
@@ -0,0 +1,44 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..8e867649c 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -3381,6 +3381,23 @@ static struct fxp_packet *fxp_packet_read(uint32_t channel_id,
+ "(%lu bytes remaining in buffer)", (unsigned long) fxp->packet_len,
+ (unsigned long) buflen);
+
++ /* We require 5 bytes of SFTP request data at a minimum: 1 byte for the
++ * request type, and 4 bytes for the payload length (Issue #2115).
++ */
++ if (fxp->packet_len < 5) {
++ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++ "illegal SFTP request length (%lu bytes, require at least 5 bytes), "
++ "rejecting", (unsigned long) fxp->packet_len);
++ SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++ }
++
++ if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
++ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++ "received excessive SFTP packet (len %lu > max %lu bytes), rejecting",
++ (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_LEN);
++ SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++ }
++
+ if (buflen == 0) {
+ fxp_packet_set_packet(fxp);
+ fxp_packet_clear_cache();
+@@ -13674,15 +13691,6 @@ int sftp_fxp_handle_packet(pool *p, void *ssh2, uint32_t channel_id,
+ (unsigned long) channel_id);
+ }
+
+- if (fxp->packet_len > FXP_MAX_PACKET_LEN) {
+- (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+- "received excessive SFTP packet (len %lu > max %lu bytes), rejecting",
+- (unsigned long) fxp->packet_len, (unsigned long) FXP_MAX_PACKET_LEN);
+- destroy_pool(fxp->pool);
+- errno = EPERM;
+- return -1;
+- }
+-
+ fxp_session = fxp_get_session(channel_id);
+ if (fxp_session == NULL) {
+ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2190.diff proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2190.diff
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2190.diff 1970-01-01 01:00:00.000000000 +0100
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/mod_sftp-1.3.8d-issue2190.diff 2026-07-22 22:58:45.000000000 +0200
@@ -0,0 +1,81 @@
+diff --git a/contrib/mod_sftp/fxp.c b/contrib/mod_sftp/fxp.c
+index d61e71046..a7631eaa4 100644
+--- a/contrib/mod_sftp/fxp.c
++++ b/contrib/mod_sftp/fxp.c
+@@ -264,11 +264,11 @@ struct fxp_buffer {
+ #define FXP_PACKET_HAVE_PAYLOAD_SIZE 0x0008
+ #define FXP_PACKET_HAVE_PAYLOAD 0x0010
+
+-/* After 32K of allocation from the scratch SFTP payload pool, destroy the
++/* After 64K of allocation from the scratch SFTP payload pool, destroy the
+ * pool and create a new one. This will prevent unbounded allocation
+ * from the pool.
+ */
+-#define FXP_PACKET_DATA_ALLOC_MAX_SZ (1024 * 32)
++#define FXP_PACKET_DATA_ALLOC_MAX_SZ (1024 * 64)
+ static size_t fxp_packet_data_allocsz = 0;
+
+ #define FXP_PACKET_DATA_DEFAULT_SZ (1024 * 16)
+@@ -3288,37 +3288,45 @@ static void fxp_packet_add_cache(unsigned char *data, uint32_t datalen) {
+
+ } else {
+ /* We need a larger buffer. Round up to the nearest 1K size. */
++ pool *tmp_pool;
++ char *cached_data;
++ uint32_t cached_datalen;
+ size_t sz;
+
+- sz = sftp_crypto_get_size(curr_buflen + datalen + 1, 1024);
++ if (curr_buflen + datalen > FXP_MAX_PACKET_LEN) {
++ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
++ "received excessive SFTP data (len %lu > max %lu bytes), rejecting",
++ (unsigned long) curr_buflen + datalen,
++ (unsigned long) FXP_MAX_PACKET_LEN);
++ SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
++ }
+
+- if (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ) {
+- pool *tmp_pool;
+- char *tmp_data;
+- uint32_t tmp_datalen;
++ /* Get the existing cached data before allocating a larger buffer. */
++ tmp_pool = make_sub_pool(fxp_pool);
++
++ cached_datalen = curr_buflen;
++ cached_data = palloc(tmp_pool, cached_datalen);
++ memcpy(cached_data, curr_buf, cached_datalen);
+
++ if (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ) {
+ (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
+ "renewing SFTP packet data pool");
+
+- tmp_pool = make_sub_pool(fxp_pool);
+- tmp_datalen = curr_buflen;
+- tmp_data = palloc(tmp_pool, tmp_datalen);
+- memcpy(tmp_data, curr_buf, tmp_datalen);
+-
+ destroy_pool(curr_buf_pool);
+
+ curr_buf_pool = make_sub_pool(fxp_pool);
+ pr_pool_tag(curr_buf_pool, "SFTP packet buffer pool");
++ }
+
+- curr_bufsz = sz;
+- curr_buf = palloc(curr_buf_pool, curr_bufsz);
+- fxp_packet_data_allocsz += sz;
++ sz = sftp_crypto_get_size(curr_buflen + datalen + 1, 1024);
++ curr_bufsz = sz;
++ curr_buf = palloc(curr_buf_pool, curr_bufsz);
++ fxp_packet_data_allocsz += sz;
+
+- memcpy(curr_buf, tmp_data, tmp_datalen);
+- curr_buflen = tmp_datalen;
++ memcpy(curr_buf, cached_data, cached_datalen);
++ curr_buflen = cached_datalen;
+
+- destroy_pool(tmp_pool);
+- }
++ destroy_pool(tmp_pool);
+ }
+
+ /* Append the SSH2 data to the current unconsumed buffer.
diff -Nru proftpd-dfsg-1.3.8.c+dfsg/debian/patches/series proftpd-dfsg-1.3.8.c+dfsg/debian/patches/series
--- proftpd-dfsg-1.3.8.c+dfsg/debian/patches/series 2026-05-01 12:47:52.000000000 +0200
+++ proftpd-dfsg-1.3.8.c+dfsg/debian/patches/series 2026-07-22 22:58:45.000000000 +0200
@@ -21,3 +21,11 @@
14c006b62c09d1efe302c57b2d183a489bcb22dc.diff
9b2b4a3e32d251798bf8fa841b124ab15ba58f11.diff
2052_pghmcfc.diff
+# issue 2057, CVE-2026-44331
+07797aba88dca902da7eaf1dfe262c8896943de7.diff
+# issue 2115, CVE-2026-53994
+mod_sftp-1.3.8d-issue2115.diff
+# issue 2201, CVE-2026-63091
+baf4b7929758c72cdb6cf16325fa25f435d23db6.diff
+# issue 2190, CVE-2026-63090
+mod_sftp-1.3.8d-issue2190.diff
signature.asc
Description: PGP signature
--- End Message ---
