Bug 13341

Summary:	[CVE 21] vsftpd 3.0.3 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	a.proklov, i.gaptrakhmanov, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2021-3618,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-05-03 18:21:51 MSK

Please patch CVEs for package vsftpd version 3.0.3
  
INFO (CVEs are): vsftpd 3.0.3
 cves found
CVE-2021-3618
Desc: ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3618
Severity: HIGH

Comment 1 ilfat 2023-05-26 12:27:15 MSK

********** QA ADVISORY **********

CVE closed by project update

Updated to 3.0.5

https://abf.io/build_lists/4445293 i686
https://abf.io/build_lists/4445292 aarch64
https://abf.io/build_lists/4445291 x86_64

Comment 2 Dmitry Postnikov 2023-05-30 13:55:02 MSK

****************************
The update sent to testings

Comment 3 Vladimir Potapov 2023-05-31 10:21:41 MSK

vsftpd-3.0.5-1
https://abf.io/build_lists/4445293 i686
https://abf.io/build_lists/4445292 aarch64
https://abf.io/build_lists/4445291 x86_64
*************************** Advisory **************************
CVE closed by project update

Updated to 3.0.5
***************************************************************
QA Verified

Comment 4 Yury 2023-07-25 16:45:28 MSK

Secteam Verified

Comment 5 Yury 2023-07-25 16:46:00 MSK

Secteam Verified