{"id":"CVE-2019-18217","aliases":["DEBIAN-CVE-2019-18217","DLA-1974-1","DSA-4559-1","EUVD-2019-8017","GHSA-5446-jrwr-x7c6","UBUNTU-CVE-2019-18217","openSUSE-SU-2020:0031-1","openSUSE-SU-2024:11196-1"],"status":"published","title":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service...","description":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.2025,"percentile":0.97486,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2019-10-21T03:12:31Z","modified":"2026-11-01T10:45:16Z","exploits":[{"source":"nuclei","id":"CVE-2019-18217","title":"ProFTPD \u003c 1.3.6b - Remote Unauthenticated DoS","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2019/CVE-2019-18217.yaml"}],"fixes":[{"ecosystem":"Debian:12","package":"proftpd-dfsg","fixed_in":["1.3.6a-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"proftpd-dfsg","fixed_in":["1.3.6a-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"proftpd-dfsg","fixed_in":["1.3.6a-2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"proftpd-dfsg","fixed_in":["1.3.5e+r1.3.5-2+deb8u4"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"proftpd-dfsg","fixed_in":["1.3.5b-4+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"proftpd-dfsg","fixed_in":["1.3.6-4+deb10u2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6a-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6a-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6a-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5e+r1.3.5-2+deb8u4"}]}],"versions":["1.3.5-1.1","1.3.5-1.1+deb8u1","1.3.5-1.1+deb8u2","1.3.5-2","1.3.5a-1","1.3.5b-1","1.3.5b-2","1.3.5b-3","1.3.5b-4","1.3.5d-1","1.3.5e+r1.3.5-2+deb8u1","1.3.5e+r1.3.5-2+deb8u2","1.3.5e+r1.3.5-2+deb8u3","1.3.5e-0+deb8u1","1.3.5e-1"]},{"source":"osv","ecosystem":"Debian:9","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5b-4+deb9u2"}]}],"versions":["1.3.5b-4","1.3.5b-4+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-4+deb10u2"}]}],"versions":["1.3.6-4","1.3.6-4+deb10u1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-2","1.3.5a-1","1.3.5a-1build1","1.3.5a-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5d-1","1.3.5e-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.6-6build2","1.3.6c-1","1.3.6c-2","1.3.6c-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.7b+dfsg-1","1.3.7c+dfsg-1build1","1.3.7c+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8+dfsg-8","1.3.8.a+dfsg-1","1.3.8.b+dfsg-1","1.3.8.b+dfsg-1build1","1.3.8.b+dfsg-1build2","1.3.8.b+dfsg-1build3","1.3.8.b+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.8.c+dfsg-2","1.3.8.c+dfsg-4","1.3.9~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.9~dfsg-4","1.3.9b~dfsg-1","1.3.9d~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"proftpd-dfsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.9~dfsg-3","1.3.9~dfsg-4"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6b-bp151.4.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"proftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6e-1.10"}]}],"bundled":7}],"products":[{"vendor":"proftpd","product":"proftpd"}],"references":[{"url":"https://github.com/proftpd/proftpd/issues/846","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/proftpd/proftpd/blob/master/NEWS","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/proftpd/proftpd/blob/1.3.6/NEWS","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00036.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJDQRVZTILBX4BUCTIRKP2WBHDHDCJR5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YLRPYEEMQJVAXO2SXRGOQ4HBFEEPCNXG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RB2FPAWDWXT5ALAFIC5Y3RSEMXSFL6H2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2019/Nov/7","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4559","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202003-35","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18217"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJDQRVZTILBX4BUCTIRKP2WBHDHDCJR5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RB2FPAWDWXT5ALAFIC5Y3RSEMXSFL6H2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YLRPYEEMQJVAXO2SXRGOQ4HBFEEPCNXG"},{"url":"https://github.com/advisories/GHSA-5446-jrwr-x7c6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-18217","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-18217","tags":["report"]},{"url":"https://github.com/proftpd/proftpd/commit/13fe9462787b9a551152162f46f1641d65fe4df4","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18217","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YQAELVZ2VM7ZCMMAPQ4KYBJ6KWLXIVC2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1113041","tags":["report"]},{"url":"https://bugzilla.suse.com/1144056","tags":["report"]},{"url":"https://bugzilla.suse.com/1154600","tags":["report"]},{"url":"https://bugzilla.suse.com/1155834","tags":["report"]},{"url":"https://bugzilla.suse.com/1156210","tags":["report"]},{"url":"https://bugzilla.suse.com/1157798","tags":["report"]},{"url":"https://bugzilla.suse.com/1157803","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19270","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9273","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-18217","description":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.","status":"published","published":"2019-10-21T03:12:31Z","modified":"2024-08-05T01:47:13.989Z","updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8017","description":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.","status":"published","published":"2019-10-21T03:12:31Z","modified":"2024-08-05T01:47:13Z","updated_at":"2026-11-03T02:40:28.860423Z"}],"ghsa":[{"id":"GHSA-5446-jrwr-x7c6","title":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service...","description":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.","status":"published","published":"2022-05-24T16:59:33Z","modified":"2024-04-04T02:31:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:56:08.751002Z"}],"nvd":[{"id":"CVE-2019-18217","description":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.","status":"published","published":"2019-10-21T04:15:10.433Z","modified":"2026-06-17T02:24:30.16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"CVE-2019-18217","description":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.","status":"published","published":"2019-10-21T04:15:10.433Z","modified":"2026-11-01T10:45:16.503913736Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-18217","description":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.","status":"published","published":"2019-10-21T04:15:10.433Z","modified":"2026-09-21T07:03:08.362893514Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-18217","description":"ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.","status":"published","published":"2019-10-21T04:15:00Z","modified":"2026-10-17T12:56:07.138184575Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-1974-1","title":"proftpd-dfsg - security update","status":"published","published":"2019-10-27T00:00:00Z","modified":"2026-03-09T01:21:48.979278Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4559-1","title":"proftpd-dfsg - security update","status":"published","published":"2019-11-05T00:00:00Z","modified":"2026-03-09T02:08:43.328891Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:0031-1","title":"Security update for proftpd","description":"This update for proftpd fixes the following issues:\n\n* GeoIP has been discontinued by Maxmind (boo#1156210)\n  This update removes module build for geoip\n    see https://support.maxmind.com/geolite-legacy-discontinuation-notice/\n\n- CVE-2019-19269: Fixed a NULL pointer dereference may occur when validating the certificate of a client connecting to the server (boo#1157803)\n- CVE-2019-19270: Fixed a Failure to check for the appropriate field of a CRL entry prevents some valid CRLs from being taken into account (boo#1157798)\n- CVE-2019-18217: Fixed remote unauthenticated denial-of-service due to incorrect handling of overly long commands (boo#1154600 gh#846)\n\nUpdate to 1.3.6b\n\n* Fixed pre-authentication remote denial-of-service issue (Issue #846).\n* Backported fix for building mod_sql_mysql using MySQL 8 (Issue #824).\n\nUpdate to 1.3.6a:\n\n* Fixed symlink navigation (Bug#4332).\n* Fixed building of mod_sftp using OpenSSL 1.1.x releases (Issue#674).\n* Fixed SITE COPY honoring of \u003cLimit\u003e restrictions (Bug#4372).\n* Fixed segfault on login when using mod_sftp + mod_sftp_pam (Issue#656).\n* Fixed restarts when using mod_facl as a static module\n* Add missing Requires(pre): group(ftp) for Leap 15 and Tumbleweed (boo#1155834)\n* Add missing Requires(pre): user(ftp) for Leap 15 and Tumbleweed (boo#1155834)\n* Use pam_keyinit.so (boo#1144056)\n\n- Reduce hard dependency on systemd to only that which is\n  necessary for building and installation.\n\nupdate to 1.3.6:\n\n* Support for using Redis for caching, logging; see the doc/howto/Redis.html\n  documentation.\n* Fixed mod_sql_postgres SSL support (Issue #415).\n* Support building against LibreSSL instead of OpenSSL (Issue #361).\n* Better support on AIX for login restraictions (Bug #4285).\n* TimeoutLogin (and other timeouts) were not working properly for SFTP\n  connections (Bug#4299).\n* Handling of the SIGILL and SIGINT signals, by the daemon process, now causes\n  the child processes to be terminated as well (Issue #461).\n* RPM .spec file naming changed to conform to Fedora guidelines.\n* Fix for 'AllowChrootSymlinks off' checking each component for symlinks (CVE-2017-7418).\n\nNew Modules:\n\n* mod_redis, mod_tls_redis, mod_wrap2_redis\n    With Redis now supported as a caching mechanism, similar to Memcache,\n    there are now Redis-using modules: mod_redis (for configuring the Redis\n    connection information), mod_tls_redis (for caching SSL sessions and\n    OCSP information using Redis), and mod_wrap2_redis (for using ACLs stored\n    in Redis).\n\nChanged Modules:\n\n* mod_ban:\n      The mod_ban module's BanCache directive can now use Redis-based caching;\n      see doc/contrib/mod_ban.html#BanCache.\n\n-New Configuration Directives\n\n* SQLPasswordArgon2, SQLPasswordScrypt\n\n      The key lengths for Argon2 and Scrypt-based passwords are now configurable\n      via these new directives; previously, the key length had been hardcoded\n      to be 32 bytes, which is not interoperable with all other implementations\n      (Issue #454).\n\nChanged Configuration Directives\n\n* AllowChrootSymlinks\n    When 'AllowChrootSymlinks off' was used, only the last portion of the\n    DefaultRoot path would be checked to see if it was a symlink.  Now,\n    each component of the DefaultRoot path will be checked to see if it is\n    a symlink when 'AllowChrootSymlinks off' is used.\n* Include\n    The Include directive can now be used within a \u003cLimit\u003e section, e.g.:\n      \u003cLimit LOGIN\u003e\n          Include /path/to/allowed.txt\n          DenyAll\n        \u003c/Limit\u003e\nAPI Changes\n  * A new JSON API has been added, for use by third-party modules. \n\n","status":"published","published":"2020-01-13T15:20:23Z","modified":"2026-02-04T03:19:18.079575Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11196-1","title":"proftpd-1.3.6e-1.10 on GA media","description":"These are all security issues fixed in the proftpd-1.3.6e-1.10 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:25.484191Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}