CVE-2019-19269
Medium
Description
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.
SeverityMedium
CVSS4.9
Exploit probability—
Product
Proftpd
PublishedNov 30, 2019
First seenNov 30, 2019
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| proftpd proftpd | v ≤ 1.3.5e, 1.3.6 | — |
| fedoraproject fedora | 30, 31 | — |
| debian debian_linux | 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.