Bug 13303

Summary:	[CVE 21] pure-ftpd 1.0.49 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	a.proklov, i.gaptrakhmanov, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2020-9274, CVE-2021-40524,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-05-03 18:02:10 MSK

Please patch CVEs for package pure-ftpd version 1.0.49
  
INFO (CVEs are): pure-ftpd 1.0.49
 cves found
CVE-2020-9274
Desc: An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-9274
Severity: HIGH
CVE-2021-40524
Desc: In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-40524
Severity: HIGH

Comment 1 ilfat 2023-05-25 00:35:28 MSK

********** QA ADVISORY **********

CVEs closed by project update

Updated to 1.0.51

https://abf.io/build_lists/4443887 i686
https://abf.io/build_lists/4443886 aarch64
https://abf.io/build_lists/4443885 x86_64

Comment 2 Dmitry Postnikov 2023-05-26 11:30:49 MSK

***************************
The update sent to testings

Comment 3 Vladimir Potapov 2023-05-31 09:33:45 MSK

pure-ftpd-1.0.51-1
https://abf.io/build_lists/4443887 i686
https://abf.io/build_lists/4443886 aarch64
https://abf.io/build_lists/4443885 x86_64
************************** Advisory ***********************
CVEs closed by project update

Updated to 1.0.51
***********************************************************
QA Verified

Comment 4 Yury 2023-07-05 11:26:06 MSK

Secteam approved