# changelog

author: Paul Howarth <paul@city-fan.org> - 1.3.6e-3
changelog:
  - Avoid segfaults with TLSv1.3
    https://github.com/proftpd/proftpd/issues/1063
    https://github.com/proftpd/proftpd/commit/adf43dd4ddaab0332e74abc86bbcef9cf27ee54a
  - Use %license unconditionally


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-4
changelog:
  - Fix memory disclosure to RADIUS servers by mod_radius (#2001690)
    https://github.com/proftpd/proftpd/issues/1284
    https://github.com/proftpd/proftpd/pull/1285


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-6
changelog:
  - Fix one-byte out-of-bounds read, and daemon crash, because of mishandling of
    quote/backslash semantics (#2255609, GH#1683, CVE-2023-51713)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-7
changelog:
  - Fix slow reading of passwd/group files in mod_auth_file (#2270686, GH#1134,
    GH#1192, GH#1195, GH#1213)


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-8
changelog:
  - Add fix for slow accesses in large directory trees (rhbz#2310341)
    - http://bugs.proftpd.org/show_bug.cgi?id=4307
    - https://github.com/proftpd/proftpd/pull/525


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-9
changelog:
  - Fix RADIUS Message-Authenticator verification in mod_radius
    - https://github.com/proftpd/proftpd/issues/1840
    - https://bugzilla.redhat.com/show_bug.cgi?id=2325448


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-10
changelog:
  - Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
    (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-11
changelog:
  - Address another avenue for SQL injection, via custom SQLUserInfo queries
    (https://github.com/proftpd/proftpd/issues/2052#issuecomment-4489110598)
  - Fix SFTP request payload length underflow calculation in mod_sftp
    (CVE-2026-53994, https://github.com/proftpd/proftpd/issues/2115)
  - Exercise caution when reading the client-provided file size for SCP uploads,
    as it could possibly overflow our size type (CVE-2026-63091)
  - Authenticated SFTP sessions could overflow the SFTP packet buffer
    (CVE-2026-63090, https://github.com/proftpd/proftpd/issues/2190)
  - Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
    /proc/self/root path prefix); this module disallows file accesses via procfs
    filesystems


author: Ján ONDREJ (SAL) <ondrejj(at)salstar.sk> - 1.8.8-1
changelog:
  - Update to upstream. Fix open redirect issue in 1.8-branch rhbz#2305065
  - pypi_source constructed manually according to project/name case inconsistency
  - only require legacy-cgi on on systems where it's present
  - remove python3.9 patch (applied upstream)


author: Bojan Smojver <bojan@rexursive com> - 4.5.1-5
changelog:
  - Drop unknown configure option --enable-tcpreplay-edit
  - Change tcpdump dependency to package
  - Remove checks for TX_RING support to avoid build problems


author: Orion Poplawski <orion@nwra.com> - 7.0.9-2
changelog:
  - Re-install SELinux module in %posttrans to address "upgrade" from zabbixA.B
    to zabbixX.Y in one transaction


