CVE Vulnerability

CVE-2019-19270

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/proftpd/proftpd/issues/859 Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QR65XUHPCRU3NXTSFVF2J4GWRIHC7AHW/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGBBCPLJSDPFG5EI5P5G7P4KEX7YSD5G/ Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html
Configurations

Configuration 1

cpe:2.3:a:proftpd:proftpd:1.3.6:-:*:*:*:*:*:*
cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*
cpe:2.3:a:proftpd:proftpd:1.3.6:alpha:*:*:*:*:*:*
cpe:2.3:a:proftpd:proftpd:1.3.6:beta:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Information

Published : 2019-11-26 04:15

Updated : 2020-01-13 10:15

NVD link : CVE-2019-19270

Mitre link : CVE-2019-19270

Products Affected
No products.
CWE
CWE-295

Improper Certificate Validation