CVE-2019-19270

HIGH7.5

An issue was discovered in tls_verify_crl in ProFTPD through 1

Published Nov 26, 2019

Modified 1 years ago

Details

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server.

References

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html

WEB

https://github.com/proftpd/proftpd/issues/859

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGBBCPLJSDPFG5EI5P5G7P4KEX7YSD5G/

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QR65XUHPCRU3NXTSFVF2J4GWRIHC7AHW/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2019-19270

CVSS Analysis