CVE-2019-19269
EUVD-2019-889530.11.2019, 23:15
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| proftpd | proftpd | 𝑥 ≤ 1.3.5e |
| proftpd | proftpd | 1.3.6 |
| proftpd | proftpd | 1.3.6:alpha |
| proftpd | proftpd | 1.3.6:beta |
| proftpd | proftpd | 1.3.6:rc1 |
| proftpd | proftpd | 1.3.6:rc2 |
| proftpd | proftpd | 1.3.6:rc3 |
| proftpd | proftpd | 1.3.6:rc4 |
| debian | debian_linux | 8.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References