The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade proftpd-dfsg | Jul 30, 2024 | Apr 5, 2016 |
| Freebsd | — | Upgrade proftpd | Dec 10, 2025 | Apr 20, 2016 |
| Oracle Solaris | — | Upgrade service/network/ftp to version 1.3.5.2-0.175.3.9.0.1.0 on Solaris 11.3 | Jun 18, 2018 | Apr 5, 2016 |
| Proftp Proftpd | — | Update ProFTP ProFTPd to the latest version | Nov 6, 2025 | Apr 5, 2016 |
| Suse | — | Upgrade proftpd-radiusUpgrade proftpd-radius-debuginfoUpgrade proftpd-docUpgrade proftpd-debugsourceUpgrade proftpdUpgrade proftpd-sqliteUpgrade proftpd-pgsqlUpgrade proftpd-langUpgrade proftpd-ldap-debuginfoUpgrade proftpd-pgsql-debuginfoUpgrade proftpd-mysql-debuginfoUpgrade proftpd-sqlite-debuginfoUpgrade proftpd-mysqlUpgrade proftpd-ldapUpgrade proftpd-develUpgrade proftpd-debuginfo | May 19, 2016 | Apr 5, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub