Homepage

Cryptographic Issues Affecting proftpd-dfsg package, versions <1.3.5-1.1+deb8u2

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.5% (77th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN8-PROFTPDDFSG-336381
  • published5 Apr 2016
  • disclosed5 Apr 2016
Report a new vulnerability Found a mistake?

Introduced: 5 Apr 2016

CVE-2016-3125  (opens in a new tab)
CWE-310  (opens in a new tab)
CWE-254  (opens in a new tab)

How to fix?

Upgrade Debian:8 proftpd-dfsg to version 1.3.5-1.1+deb8u2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream proftpd-dfsg package and not the proftpd-dfsg package as distributed by Debian. See How to fix? for Debian:8 relevant fixed versions and status.

The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.