Bug 33922 - proftpd new security issue CVE-2024-48651
Summary: proftpd new security issue CVE-2024-48651
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-01-15 11:25 CET by Nicolas Salguero
Modified: 2025-01-20 19:24 CET (History)
3 users (show)

See Also:
Source RPM: proftpd-1.3.8b-1.mga9.src.rpm
CVE: CVE-2024-48651
Status comment:


Attachments

Description Nicolas Salguero 2025-01-15 11:25:30 CET
openSUSE has issued an advisory on January 13:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VVHALJQJ6EOQ3LXU5PV576XZHRQTOZGI/
Nicolas Salguero 2025-01-15 11:27:42 CET

Whiteboard: (none) => MGA9TOO
Source RPM: (none) => proftpd-1.3.8b-2.mga10.src.rpm, proftpd-1.3.8b-1.mga9.src.rpm
CVE: (none) => CVE-2024-48651
Status comment: (none) => Fixed upstream in 1.3.8c (1.3.8d fixes another problem)

Nicolas Salguero 2025-01-15 11:32:12 CET

Status comment: Fixed upstream in 1.3.8c (1.3.8d fixes another problem) => Fixed upstream in 1.3.8c

Comment 1 Nicolas Salguero 2025-01-15 11:41:34 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql. (CVE-2024-48651)

References:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VVHALJQJ6EOQ3LXU5PV576XZHRQTOZGI/
========================

Updated packages in core/updates_testing:
========================
proftpd-1.3.8c-1.mga9
proftpd-devel-1.3.8c-1.mga9
proftpd-mod_autohost-1.3.8c-1.mga9
proftpd-mod_ban-1.3.8c-1.mga9
proftpd-mod_case-1.3.8c-1.mga9
proftpd-mod_ctrls_admin-1.3.8c-1.mga9
proftpd-mod_ifsession-1.3.8c-1.mga9
proftpd-mod_ldap-1.3.8c-1.mga9
proftpd-mod_load-1.3.8c-1.mga9
proftpd-mod_memcache-1.3.8c-1.mga9
proftpd-mod_quotatab-1.3.8c-1.mga9
proftpd-mod_quotatab_file-1.3.8c-1.mga9
proftpd-mod_quotatab_ldap-1.3.8c-1.mga9
proftpd-mod_quotatab_radius-1.3.8c-1.mga9
proftpd-mod_quotatab_sql-1.3.8c-1.mga9
proftpd-mod_radius-1.3.8c-1.mga9
proftpd-mod_ratio-1.3.8c-1.mga9
proftpd-mod_rewrite-1.3.8c-1.mga9
proftpd-mod_sftp-1.3.8c-1.mga9
proftpd-mod_sftp_pam-1.3.8c-1.mga9
proftpd-mod_sftp_sql-1.3.8c-1.mga9
proftpd-mod_shaper-1.3.8c-1.mga9
proftpd-mod_site_misc-1.3.8c-1.mga9
proftpd-mod_sql-1.3.8c-1.mga9
proftpd-mod_sql_mysql-1.3.8c-1.mga9
proftpd-mod_sql_passwd-1.3.8c-1.mga9
proftpd-mod_sql_postgres-1.3.8c-1.mga9
proftpd-mod_sql_sqlite-1.3.8c-1.mga9
proftpd-mod_tls-1.3.8c-1.mga9
proftpd-mod_tls_memcache-1.3.8c-1.mga9
proftpd-mod_tls_shmcache-1.3.8c-1.mga9
proftpd-mod_unique_id-1.3.8c-1.mga9
proftpd-mod_vroot-1.3.8c-1.mga9
proftpd-mod_wrap-1.3.8c-1.mga9
proftpd-mod_wrap_file-1.3.8c-1.mga9
proftpd-mod_wrap_sql-1.3.8c-1.mga9

from SRPM:
proftpd-1.3.8c-1.mga9.src.rpm

Source RPM: proftpd-1.3.8b-2.mga10.src.rpm, proftpd-1.3.8b-1.mga9.src.rpm => proftpd-1.3.8b-1.mga9.src.rpm
Status comment: Fixed upstream in 1.3.8c => (none)
Assignee: bugsquad => qa-bugs
Version: Cauldron => 9
Status: NEW => ASSIGNED
Whiteboard: MGA9TOO => (none)

katnatek 2025-01-15 20:17:44 CET

Keywords: (none) => advisory

Comment 2 Herman Viaene 2025-01-17 11:15:13 CET
MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Ref bug 29449 for testing.
Opened firewall for ftp
# systemctl  start proftpd
# systemctl -l status proftpd
● proftpd.service - LSB: ProFTPD FTP server
     Loaded: loaded (/etc/rc.d/init.d/proftpd; generated)
     Active: active (running) since Fri 2025-01-17 11:00:52 CET; 5min ago
       Docs: man:systemd-sysv-generator(8)
    Process: 4363 ExecStart=/etc/rc.d/init.d/proftpd start (code=exited, status=0/SUCCESS)
      Tasks: 1 (limit: 8806)
     Memory: 3.1M
        CPU: 267ms
     CGroup: /system.slice/proftpd.service
             └─4404 "proftpd: (accepting connections)"

Jan 17 11:00:52 mach3.hviaene.thuis systemd[1]: Starting proftpd.service...
Jan 17 11:00:52 mach3.hviaene.thuis proftpd[4363]: Starting proftpd[  OK  ]
Jan 17 11:00:52 mach3.hviaene.thuis systemd[1]: Started proftpd.service.
Used filezilla to transfer some files, testing in both directions. All worked OK.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Comment 3 Thomas Andrews 2025-01-20 14:34:12 CET
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 4 Mageia Robot 2025-01-20 19:24:04 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0015.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.