Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:proftpd-dfsg User: [email protected] Usertags: pu
[ Reason ] The fault description from the bug report suggests a severe issue in proftp, which makes the FTP unusable (possible DoS attack) for some setups. I'm unsure if the issue was introduced during trixie. [ Impact ] Just quoting from the bug report: With several <VirtualHost>s on one address/port selected by TLS SNI, TLSv1.2 and "TLSSessionCache internal", a session whose TLS data connection resumes the control session never exits when it ends (QUIT or a dropped connection). The session process spins at 100% CPU in SSL_CTX_flush_sessions_ex(), its heap grows by ~10-20 MB/s, and it finally aborts with "double free or corruption (!prev)". Without a session RLimitMemory, a few such sessions exhaust the host's memory (for us: an OOM kill of the whole FTP container, dropping every user's connection). Any authenticated user can trigger it, and FileZilla does it routinely, because it resumes the TLS session on every data connection. [ Tests ] Upstream provides a test suite, which is passed. [ Risks ] Upstream test suite passes. Fix is in unstable for a while now. [ Checklist ] [X] *all* changes are documented in the d/changelog [X] I reviewed all changes and I approve them [X] attach debdiff against the package in (old)stable [X] the issue is verified as fixed in unstable [ Changes ] The debdiff contains three pull requests from upstream, which fixes the SSL session issues.
debdiff.diff.xz
Description: application/xz
signature.asc
Description: PGP signature
