The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade proftpd-dfsg | Jul 30, 2024 | Apr 5, 2016 |
| Freebsd | — | Upgrade proftpd | Dec 10, 2025 | Apr 20, 2016 |
| Oracle Solaris | — | Upgrade service/network/ftp to version 1.3.5.2-0.175.3.9.0.1.0 on Solaris 11.3 | Jun 18, 2018 | Apr 5, 2016 |
| Proftp Proftpd | — | Update ProFTP ProFTPd to the latest version | Nov 6, 2025 | Apr 5, 2016 |
| Suse | — | Upgrade proftpd-ldap-debuginfoUpgrade proftpd-debuginfoUpgrade proftpd-ldapUpgrade proftpd-develUpgrade proftpd-sqlite-debuginfoUpgrade proftpd-mysqlUpgrade proftpd-mysql-debuginfoUpgrade proftpd-pgsql-debuginfoUpgrade proftpd-pgsqlUpgrade proftpd-docUpgrade proftpdUpgrade proftpd-sqliteUpgrade proftpd-radiusUpgrade proftpd-debugsourceUpgrade proftpd-radius-debuginfoUpgrade proftpd-lang | May 19, 2016 | Apr 5, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub