CVE-2024-48651
Fixed in a distro release EPSS 2%CVSS 7.5
In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.
Products: ProFTPD
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | proftpd-dfsg | 1.3.7a+dfsg-12+deb11u3 |
| Debian 12 | proftpd-dfsg | 1.3.8+dfsg-4+deb12u4 |
| Debian 13 | proftpd-dfsg | 1.3.8.b+dfsg-4 |
| Debian 14 | proftpd-dfsg | 1.3.8.b+dfsg-4 |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | proftpd | 1.3.8b-150600.13.6.1 |
| Ubuntu 20.04 LTS | proftpd-dfsg | 1.3.6c-2ubuntu0.1 |
| Ubuntu 22.04 LTS | proftpd-dfsg | 1.3.7c+dfsg-1ubuntu0.1 |
| Ubuntu 24.04 LTS | proftpd-dfsg | 1.3.8.b+dfsg-1ubuntu0.1 |
| openSUSE Leap 15.6 | proftpd | 1.3.8b-150600.13.6.1 |
| openSUSE Tumbleweed | proftpd | 1.3.8c-1.1 |