Bug 276168 - ftp/proftpd needs update to 1.3.8b security fix for CVE-2023-48795
Summary: ftp/proftpd needs update to 1.3.8b security fix for CVE-2023-48795
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Martin Matuska
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-07 10:07 UTC by Miroslav Lachman
Modified: 2024-01-08 00:11 UTC (History)
0 users

See Also:
bugzilla: maintainer-feedback? (mm)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Miroslav Lachman 2024-01-07 10:07:59 UTC 
ProFTPD released 1.3.8b at 2023-12-19, it contains important security fix for "Terrapin" SSH attack (CVE-2023-48795), and version 1.3.8a has fixed build when using OpenSSL 3.x
http://proftpd.org/docs/NEWS-1.3.8b
http://proftpd.org/docs/RELEASE_NOTES-1.3.8b
Comment 1 commit-hook freebsd_committer freebsd_triage 2024-01-08 00:08:27 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=fc281da4dc2af0f1aaac1fc3ca29fa6f04dcdcc9

commit fc281da4dc2af0f1aaac1fc3ca29fa6f04dcdcc9
Author:     Martin Matuska <mm@FreeBSD.org>
AuthorDate: 2024-01-08 00:00:42 +0000
Commit:     Martin Matuska <mm@FreeBSD.org>
CommitDate: 2024-01-08 00:08:05 +0000

    ftp/proftpd: update to 1.3.8b and add libsodium support

    Provides mitigation for "Terrapin" SSH attack.
    Support stronger key algorithms using libsodium by default.

    PR:             265590, 276168
    Security:       CVE-2023-48795

 databases/proftpd-mod_sql_tds/distinfo |  6 +++---
 ftp/proftpd-mod_vroot/distinfo         |  6 +++---
 ftp/proftpd/Makefile                   | 13 +++++++++----
 ftp/proftpd/distinfo                   |  6 +++---
 security/proftpd-mod_clamav/distinfo   |  6 +++---
 5 files changed, 21 insertions(+), 16 deletions(-)