Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-19270

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server.

Published

2019-11-26T04:15:12.950

Last Modified

2024-11-21T04:34:27.963

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-295
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application proftpd proftpd ≤ 1.3.5 Yes
Application proftpd proftpd 1.3.6 Yes
Application proftpd proftpd 1.3.6 Yes
Application proftpd proftpd 1.3.6 Yes
Operating System fedoraproject fedora 30 Yes
Operating System fedoraproject fedora 31 Yes
References