Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package proftpd for openSUSE:Factory checked in at 2026-11-10 14:44:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/proftpd (Old) and /work/SRC/openSUSE:Factory/.proftpd.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "proftpd" Tue Nov 10 14:44:02 2026 rev:63 rq:1396476 version:1.3.9e Changes: -------- --- /work/SRC/openSUSE:Factory/proftpd/proftpd.changes 2026-11-05 18:22:27.967077928 +0100 +++ /work/SRC/openSUSE:Factory/.proftpd.new.3759290/proftpd.changes 2026-11-10 14:45:42.090840033 +0100 @@ -1,0 +2,18 @@ +Mon Nov 9 17:35:13 UTC 2026 - Peter Simons <[email protected]> + +- Apply "CVE-2026-35025.patch" to add the mod_procfs module from + upstream (as of commit 448f055b1) and build it as a core module, + as upstream does starting with 1.3.10rc3. Authenticated FTP users + could bypass <Directory> ACL restrictions by prefixing paths with + /proc/self/root, e.g. via RNFR. mod_procfs automatically rejects + client requests that reference procfs and sysfs mount points in + sessions that are not chrooted; it can be disabled with + "ProcfsEngine off". [bsc#1269065, CVE-2026-35025] + +------------------------------------------------------------------- +Thu Nov 5 11:24:26 UTC 2026 - Peter Simons <[email protected]> + +- Mark the proftpd-doc subpackage as noarch to fix the rpmlint + no-binary error. + +------------------------------------------------------------------- @@ -7 +25,4 @@ - * https://github.com/proftpd/proftpd/blob/v1.3.9d/NEWS + * https://github.com/proftpd/proftpd/blob/v1.3.9e/NEWS + * fix for bsc#1271945, bsc#1271097 (CVE-2026-63091), completed: + properly detect ERANGE conversion errors for client-sent SCP file + sizes @@ -12 +33 @@ - * https://github.com/proftpd/proftpd/blob/v1.3.9e/NEWS + * https://github.com/proftpd/proftpd/blob/v1.3.9d/NEWS @@ -29,0 +51,9 @@ + * fix for bsc#1271944, bsc#1271096 (CVE-2026-63090) + Allocate sufficient space when assembling fragmented SFTP request + chunks (Issue #2190) + * fix for bsc#1271945, bsc#1271097 (CVE-2026-63091) + Guard against overflow of the client-provided file size for SCP + uploads + * fix for bsc#1263183 (CVE-2026-42167) + mod_sql now escapes client-provided group names for name-to-GID + lookups (Issue #2188) @@ -41,0 +72,6 @@ + * fix for bsc#1263183 (CVE-2026-42167), additional fixes as above + * fix for bsc#1264262 (CVE-2026-44331) + SQL injection in mod_wrap2_sql via reverse DNS hostname (Issue #2057) + * fix for bsc#1271946 (CVE-2026-53994) + Heap-based buffer overflow in mod_sftp due to SFTP request payload + length underflow (Issue #2115) @@ -44,0 +81,3 @@ + * fix for bsc#1263183 (CVE-2026-42167) + SQL injection via mod_sql because of is_escaped_text() logic error + (Issue #2052) New: ---- CVE-2026-35025.patch ----------(New B)---------- New: - Apply "CVE-2026-35025.patch" to add the mod_procfs module from upstream (as of commit 448f055b1) and build it as a core module, ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ proftpd.spec ++++++ --- /var/tmp/diff_new_pack.dqcoed/_old 2026-11-10 14:45:43.278889804 +0100 +++ /var/tmp/diff_new_pack.dqcoed/_new 2026-11-10 14:45:43.280889887 +0100 @@ -53,6 +53,8 @@ Patch105: %{name}_env-script-interpreter.patch #openSUSE:Security_Features#Systemd_hardening_effort Patch106: harden_proftpd.service.patch +# PATCH-FIX-UPSTREAM CVE-2026-35025.patch bsc#1269065 -- add mod_procfs core module to block procfs/sysfs paths (Issue #2170) +Patch107: CVE-2026-35025.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build # BuildRequires: cyrus-sasl-devel @@ -146,6 +148,7 @@ %package doc Summary: Documentation for ProFTPD Group: Documentation/HTML +BuildArch: noarch Requires: %{name} = %{version} %description doc ++++++ CVE-2026-35025.patch ++++++ ++++ 979 lines (skipped)
