CVE-2019-19270 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2019-19270 Interim 1 18 2025-08-14T01:53:45Z current 2021-05-30T14:33:27Z 2025-08-14T01:53:45Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2019-19270 An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YQAELVZ2VM7ZCMMAPQ4KYBJ6KWLXIVC2/ E-Mail link for openSUSE-SU-2020:0031-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Package Hub 15 SUSE Package Hub 15 SP1 openSUSE Leap 15.1 proftpd-1.3.6b-bp150.3.6.1 proftpd-1.3.6b-bp151.4.6.2 proftpd-1.3.6b-lp151.3.6.1 proftpd-1.3.8b-150600.13.6.1 proftpd-devel-1.3.6b-bp150.3.6.1 proftpd-devel-1.3.6b-bp151.4.6.2 proftpd-devel-1.3.6b-lp151.3.6.1 proftpd-devel-1.3.8b-150600.13.6.1 proftpd-doc-1.3.6b-bp150.3.6.1 proftpd-doc-1.3.6b-bp151.4.6.2 proftpd-doc-1.3.6b-lp151.3.6.1 proftpd-doc-1.3.8b-150600.13.6.1 proftpd-lang-1.3.6b-bp150.3.6.1 proftpd-lang-1.3.6b-bp151.4.6.2 proftpd-lang-1.3.6b-lp151.3.6.1 proftpd-lang-1.3.8b-150600.13.6.1 proftpd-ldap-1.3.6b-bp150.3.6.1 proftpd-ldap-1.3.6b-bp151.4.6.2 proftpd-ldap-1.3.6b-lp151.3.6.1 proftpd-ldap-1.3.8b-150600.13.6.1 proftpd-mysql-1.3.6b-bp150.3.6.1 proftpd-mysql-1.3.6b-bp151.4.6.2 proftpd-mysql-1.3.6b-lp151.3.6.1 proftpd-mysql-1.3.8b-150600.13.6.1 proftpd-pgsql-1.3.6b-bp150.3.6.1 proftpd-pgsql-1.3.6b-bp151.4.6.2 proftpd-pgsql-1.3.6b-lp151.3.6.1 proftpd-pgsql-1.3.8b-150600.13.6.1 proftpd-radius-1.3.6b-bp150.3.6.1 proftpd-radius-1.3.6b-bp151.4.6.2 proftpd-radius-1.3.6b-lp151.3.6.1 proftpd-radius-1.3.8b-150600.13.6.1 proftpd-sqlite-1.3.6b-bp150.3.6.1 proftpd-sqlite-1.3.6b-bp151.4.6.2 proftpd-sqlite-1.3.6b-lp151.3.6.1 proftpd-sqlite-1.3.8b-150600.13.6.1 proftpd-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-devel-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-doc-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-lang-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-ldap-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-mysql-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-pgsql-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-radius-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-sqlite-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-devel-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-doc-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-lang-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-ldap-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-mysql-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-pgsql-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-radius-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-sqlite-1.3.6b-bp150.3.6.1 as a component of SUSE Package Hub 15 proftpd-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-devel-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-doc-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-lang-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-ldap-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-mysql-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-pgsql-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-radius-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-sqlite-1.3.6b-bp151.4.6.2 as a component of SUSE Package Hub 15 SP1 proftpd-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 proftpd-devel-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 proftpd-doc-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 proftpd-lang-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 proftpd-ldap-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 proftpd-mysql-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 proftpd-pgsql-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 proftpd-radius-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 proftpd-sqlite-1.3.6b-lp151.3.6.1 as a component of openSUSE Leap 15.1 An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server. CVE-2019-19270 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-devel-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-doc-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-lang-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-ldap-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-mysql-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-pgsql-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-radius-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-sqlite-1.3.8b-150600.13.6.1 SUSE Package Hub 15:proftpd-1.3.6b-bp150.3.6.1 SUSE Package Hub 15:proftpd-devel-1.3.6b-bp150.3.6.1 SUSE Package Hub 15:proftpd-doc-1.3.6b-bp150.3.6.1 SUSE Package Hub 15:proftpd-lang-1.3.6b-bp150.3.6.1 SUSE Package Hub 15:proftpd-ldap-1.3.6b-bp150.3.6.1 SUSE Package Hub 15:proftpd-mysql-1.3.6b-bp150.3.6.1 SUSE Package Hub 15:proftpd-pgsql-1.3.6b-bp150.3.6.1 SUSE Package Hub 15:proftpd-radius-1.3.6b-bp150.3.6.1 SUSE Package Hub 15:proftpd-sqlite-1.3.6b-bp150.3.6.1 SUSE Package Hub 15 SP1:proftpd-1.3.6b-bp151.4.6.2 SUSE Package Hub 15 SP1:proftpd-devel-1.3.6b-bp151.4.6.2 SUSE Package Hub 15 SP1:proftpd-doc-1.3.6b-bp151.4.6.2 SUSE Package Hub 15 SP1:proftpd-lang-1.3.6b-bp151.4.6.2 SUSE Package Hub 15 SP1:proftpd-ldap-1.3.6b-bp151.4.6.2 SUSE Package Hub 15 SP1:proftpd-mysql-1.3.6b-bp151.4.6.2 SUSE Package Hub 15 SP1:proftpd-pgsql-1.3.6b-bp151.4.6.2 SUSE Package Hub 15 SP1:proftpd-radius-1.3.6b-bp151.4.6.2 SUSE Package Hub 15 SP1:proftpd-sqlite-1.3.6b-bp151.4.6.2 openSUSE Leap 15.1:proftpd-1.3.6b-lp151.3.6.1 openSUSE Leap 15.1:proftpd-devel-1.3.6b-lp151.3.6.1 openSUSE Leap 15.1:proftpd-doc-1.3.6b-lp151.3.6.1 openSUSE Leap 15.1:proftpd-lang-1.3.6b-lp151.3.6.1 openSUSE Leap 15.1:proftpd-ldap-1.3.6b-lp151.3.6.1 openSUSE Leap 15.1:proftpd-mysql-1.3.6b-lp151.3.6.1 openSUSE Leap 15.1:proftpd-pgsql-1.3.6b-lp151.3.6.1 openSUSE Leap 15.1:proftpd-radius-1.3.6b-lp151.3.6.1 openSUSE Leap 15.1:proftpd-sqlite-1.3.6b-lp151.3.6.1 important 5 AV:N/AC:L/Au:N/C:N/I:P/A:N 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N