In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.

Affected: openEuler:20.03-LTS-SP4: proftpd, openEuler:22.03-LTS-SP1: proftpd, openEuler:24.03-LTS: proftpd, openEuler:22.03-LTS-SP4: proftpd, openEuler:22.03-LTS-SP3: proftpd

ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif Security Fix(es): In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.(CVE-2024-48651)

proftpd-1.3.8c-1.1 on GA media

Security update for proftpd

Affected: Ubuntu:20.04:LTS: proftpd-dfsg, Ubuntu:22.04:LTS: proftpd-dfsg, Ubuntu:24.04:LTS: proftpd-dfsg

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.

Ein lokaler Angreifer kann eine Schwachstelle in ProFTPD ausnutzen, um seine Privilegien zu erhöhen.