CVE-2019-18217

NameCVE-2019-18217
DescriptionProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1974-1, DSA-4559-1
Debian Bugs942831

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
proftpd-dfsg (PTS)buster1.3.6-4+deb10u6fixed
buster (security)1.3.6-4+deb10u4fixed
bullseye1.3.7a+dfsg-12+deb11u2fixed
bookworm1.3.8+dfsg-4+deb12u3fixed
trixie1.3.8.b+dfsg-1fixed
sid1.3.8.b+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
proftpd-dfsgsourcejessie1.3.5e+r1.3.5-2+deb8u4DLA-1974-1
proftpd-dfsgsourcestretch1.3.5b-4+deb9u2DSA-4559-1
proftpd-dfsgsourcebuster1.3.6-4+deb10u2DSA-4559-1
proftpd-dfsgsource(unstable)1.3.6a-2942831

Notes

https://github.com/proftpd/proftpd/commit/13fe9462787b9a551152162f46f1641d65fe4df4
https://github.com/proftpd/proftpd/issues/846
Search for package or bug name: Reporting problems