{"id":"CVE-2017-7418","aliases":["DEBIAN-CVE-2017-7418","EUVD-2017-16442","GHSA-mq6p-g6qc-37c9","MGASA-2017-0115","UBUNTU-CVE-2017-7418","openSUSE-SU-2019:1836-1","openSUSE-SU-2019:1870-1","openSUSE-SU-2020:0031-1","openSUSE-SU-2024:11196-1"],"status":"published","title":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user...","description":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00436,"percentile":0.38117,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2017-04-04T17:00:00Z","modified":"2026-11-01T19:19:38Z","fixes":[{"ecosystem":"Debian:12","package":"proftpd-dfsg","fixed_in":["1.3.5b-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"proftpd-dfsg","fixed_in":["1.3.5b-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"proftpd-dfsg","fixed_in":["1.3.5b-4"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"proftpd","fixed_in":["1.3.5e-1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5b-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5b-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5b-4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-2","1.3.5a-1","1.3.5a-1build1","1.3.5a-1ubuntu0.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e-bp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6e-1.10"}]}],"bundled":7}],"products":[{"vendor":"proftpd","product":"proftpd"}],"references":[{"url":"https://github.com/proftpd/proftpd/commit/ecff21e0d0e84f35c299ef91d7fda088e516d4ed","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/proftpd/proftpd/commit/f59593e6ff730b832dbe8754916cb5c821db579f","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://bugs.proftpd.org/show_bug.cgi?id=4295","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/97409","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/proftpd/proftpd/pull/444/commits/349addc3be4fcdad9bd4ec01ad1ccd916c898ed8","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7418"},{"url":"https://github.com/advisories/GHSA-mq6p-g6qc-37c9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7418","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0115.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20640","tags":["report"]},{"url":"http://www.proftpd.org/docs/RELEASE_NOTES-1.3.5e","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-7418","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7418","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KXPGYD3YUWLXQJZK2Q7OAYM2YSWGXNUI/#KXPGYD3YUWLXQJZK2Q7OAYM2YSWGXNUI","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1142281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12815","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2TKHSM2I77TZO2WX6JAB2SHAW5JQZGWZ/#2TKHSM2I77TZO2WX6JAB2SHAW5JQZGWZ","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YQAELVZ2VM7ZCMMAPQ4KYBJ6KWLXIVC2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1113041","tags":["report"]},{"url":"https://bugzilla.suse.com/1144056","tags":["report"]},{"url":"https://bugzilla.suse.com/1154600","tags":["report"]},{"url":"https://bugzilla.suse.com/1155834","tags":["report"]},{"url":"https://bugzilla.suse.com/1156210","tags":["report"]},{"url":"https://bugzilla.suse.com/1157798","tags":["report"]},{"url":"https://bugzilla.suse.com/1157803","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19270","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9273","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7418","description":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.","status":"published","published":"2017-04-04T17:00:00Z","modified":"2024-08-05T16:04:11.362Z","updated_at":"2026-11-02T14:33:20.171335Z"}],"euvd":[{"id":"EUVD-2017-16442","description":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.","status":"published","published":"2017-04-04T17:00:00Z","modified":"2024-08-05T16:04:11Z","updated_at":"2026-11-03T02:39:08.461482Z"}],"ghsa":[{"id":"GHSA-mq6p-g6qc-37c9","title":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user...","description":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.","status":"published","published":"2022-05-14T00:54:20Z","modified":"2023-02-02T05:02:33Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:51:28.259401Z"}],"nvd":[{"id":"CVE-2017-7418","description":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.","status":"published","published":"2017-04-04T17:59:00.337Z","modified":"2026-06-17T01:24:18.737Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:03:44.86906Z"}],"osv":[{"id":"CVE-2017-7418","description":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.","status":"published","published":"2017-04-04T17:59:00.337Z","modified":"2026-11-01T19:19:38.85594806Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7418","description":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.","status":"published","published":"2017-04-04T17:59:00.337Z","modified":"2026-09-01T20:03:50.024207078Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-7418","description":"ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.","status":"published","published":"2017-04-04T17:59:00Z","modified":"2026-04-22T11:31:41.081857Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"MGASA-2017-0115","title":"Updated proftpd packages fix security vulnerability","description":"ProFTPD before 1.3.5e controls whether the home directory of a user could\ncontain a symbolic link through the AllowChrootSymlinks configuration\noption, but checks only the last path component when enforcing\nAllowChrootSymlinks. Attackers with local access could bypass the\nAllowChrootSymlinks control by replacing a path component (other than the\nlast one) with a symbolic link. The threat model includes an attacker who\nis not granted full filesystem access by a hosting provider, but can\nreconfigure the home directory of an FTP user (CVE-2017-7418).\n","status":"published","published":"2017-04-24T07:27:32Z","modified":"2026-04-16T06:25:00.324918546Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2019:1836-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-12815: Fixed arbitrary file copy in mod_copy that allowed for remote code execution and information disclosure without authentication (bnc#1142281).\n","status":"published","published":"2019-08-08T09:05:33Z","modified":"2026-02-04T04:35:16.466401Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1870-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-12815: Fixed arbitrary file copy in mod_copy that allowed for remote code execution and information disclosure without authentication (bnc#1142281).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-08-14T05:59:02Z","modified":"2026-02-04T03:19:45.71759Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2020:0031-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\n* GeoIP has been discontinued by Maxmind (boo#1156210)\n  This update removes module build for geoip\n    see https://support.maxmind.com/geolite-legacy-discontinuation-notice/\n\n- CVE-2019-19269: Fixed a NULL pointer dereference may occur when validating the certificate of a client connecting to the server (boo#1157803)\n- CVE-2019-19270: Fixed a Failure to check for the appropriate field of a CRL entry prevents some valid CRLs from being taken into account (boo#1157798)\n- CVE-2019-18217: Fixed remote unauthenticated denial-of-service due to incorrect handling of overly long commands (boo#1154600 gh#846)\n\nUpdate to 1.3.6b\n\n* Fixed pre-authentication remote denial-of-service issue (Issue #846).\n* Backported fix for building mod_sql_mysql using MySQL 8 (Issue #824).\n\nUpdate to 1.3.6a:\n\n* Fixed symlink navigation (Bug#4332).\n* Fixed building of mod_sftp using OpenSSL 1.1.x releases (Issue#674).\n* Fixed SITE COPY honoring of \u003cLimit\u003e restrictions (Bug#4372).\n* Fixed segfault on login when using mod_sftp + mod_sftp_pam (Issue#656).\n* Fixed restarts when using mod_facl as a static module\n* Add missing Requires(pre): group(ftp) for Leap 15 and Tumbleweed (boo#1155834)\n* Add missing Requires(pre): user(ftp) for Leap 15 and Tumbleweed (boo#1155834)\n* Use pam_keyinit.so (boo#1144056)\n\n- Reduce hard dependency on systemd to only that which is\n  necessary for building and installation.\n\nupdate to 1.3.6:\n\n* Support for using Redis for caching, logging; see the doc/howto/Redis.html\n  documentation.\n* Fixed mod_sql_postgres SSL support (Issue #415).\n* Support building against LibreSSL instead of OpenSSL (Issue #361).\n* Better support on AIX for login restraictions (Bug #4285).\n* TimeoutLogin (and other timeouts) were not working properly for SFTP\n  connections (Bug#4299).\n* Handling of the SIGILL and SIGINT signals, by the daemon process, now causes\n  the child processes to be terminated as well (Issue #461).\n* RPM .spec file naming changed to conform to Fedora guidelines.\n* Fix for 'AllowChrootSymlinks off' checking each component for symlinks (CVE-2017-7418).\n\nNew Modules:\n\n* mod_redis, mod_tls_redis, mod_wrap2_redis\n    With Redis now supported as a caching mechanism, similar to Memcache,\n    there are now Redis-using modules: mod_redis (for configuring the Redis\n    connection information), mod_tls_redis (for caching SSL sessions and\n    OCSP information using Redis), and mod_wrap2_redis (for using ACLs stored\n    in Redis).\n\nChanged Modules:\n\n* mod_ban:\n      The mod_ban module's BanCache directive can now use Redis-based caching;\n      see doc/contrib/mod_ban.html#BanCache.\n\n-New Configuration Directives\n\n* SQLPasswordArgon2, SQLPasswordScrypt\n\n      The key lengths for Argon2 and Scrypt-based passwords are now configurable\n      via these new directives; previously, the key length had been hardcoded\n      to be 32 bytes, which is not interoperable with all other implementations\n      (Issue #454).\n\nChanged Configuration Directives\n\n* AllowChrootSymlinks\n    When 'AllowChrootSymlinks off' was used, only the last portion of the\n    DefaultRoot path would be checked to see if it was a symlink.  Now,\n    each component of the DefaultRoot path will be checked to see if it is\n    a symlink when 'AllowChrootSymlinks off' is used.\n* Include\n    The Include directive can now be used within a \u003cLimit\u003e section, e.g.:\n      \u003cLimit LOGIN\u003e\n          Include /path/to/allowed.txt\n          DenyAll\n        \u003c/Limit\u003e\nAPI Changes\n  * A new JSON API has been added, for use by third-party modules. \n\n","status":"published","published":"2020-01-13T15:20:23Z","modified":"2026-02-04T03:19:18.079575Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11196-1","title":"proftpd-1.3.6e-1.10 on GA media","description":"These are all security issues fixed in the proftpd-1.3.6e-1.10 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:25.484191Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}