NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/proftpd: security bump to version 1.3.6c

Browse Source 
Fixes the following security issues:

- CVE-2020-9273: In ProFTPD 1.3.7, it is possible to corrupt the memory pool
  by interrupting the data transfer channel.  This triggers a use-after-free
  in alloc_pool in pool.c, and possible remote code execution.

And additionally, fixes a number of other issues.  For details, see the
release notes:

https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES

This also bumps the bundled libcap, so
0001-fix-kernel-header-capability-version.patch can be dropped.

While we are at it, adjust the white space in the .hash function to match
the new agreements.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Peter Korsgaard 2020-02-27 14:54:56 +01:00 committed by Thomas Petazzoni
parent 128c57adb8
commit a1859b6204
3 changed files with 3 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
package/proftpd/0001-fix-kernel-header-capability-version.patch
View File

@ -1,12 +0,0 @@
--- a/lib/libcap/libcap.h 2008-08-22 19:49:48.000000000 -0700
+++ b/lib/libcap/libcap.h 2010-10-06 15:31:11.000000000 -0700
@@ -65,7 +65,8 @@ struct _cap_struct {
*/
#if !defined(_LINUX_CAPABILITY_VERSION_1) || \
- (_LINUX_CAPABILITY_VERSION_1 != 0x19980330)
+ ((_LINUX_CAPABILITY_VERSION_1 != 0x19980330) && \
+ (_LINUX_CAPABILITY_VERSION_1 != 0x20071026))
# error "Kernel <linux/capability.h> does not match library"
# error "file "libcap.h" --> fix and recompile libcap"

4
package/proftpd/proftpd.hash
View File

@ -1,3 +1,3 @@
# Locally calculated
sha256 fe5baf6c469a2b0b7f0e2611561b6fd5414300e32a76b96adb2ccfe05b5efb60 proftpd-1.3.6b.tar.gz
sha256 391a473d755c29b5326fb726326ff3c37e42512f53a8f5789fc310232150bf80 COPYING
sha256 fa3541c4b34136a7b80cb12a2f6f9a0cab5118a5b0a1653d40af49c6479c35ad proftpd-1.3.6c.tar.gz
sha256 391a473d755c29b5326fb726326ff3c37e42512f53a8f5789fc310232150bf80 COPYING

2
package/proftpd/proftpd.mk
View File

@ -4,7 +4,7 @@
#
################################################################################
PROFTPD_VERSION = 1.3.6b
PROFTPD_VERSION = 1.3.6c
PROFTPD_SITE = $(call github,proftpd,proftpd,v$(PROFTPD_VERSION))
PROFTPD_LICENSE = GPL-2.0+
PROFTPD_LICENSE_FILES = COPYING