# changelog

author: Eduardo Echeverria <echevemaster@gmail.com> - 1.11-1
changelog:
  - Update to 1.11. Fixes rhbz#2502800
  - Added automatic, crash-safe migration of persisted databases to storage
    format version 3
  - Added configured zlib and AddressSanitizer options to the version output
  - Added fullscreen expand and collapse controls to geolocation maps in the
    HTML report
  - Added Traditional Chinese translation
  - Expanded Debian package builds to Ubuntu 26.04 and additional
    architectures, and updated the packaging workflow actions
  - Fixed a heap buffer overflow when parsing malformed Opera user agents
  - Fixed an infinite loop while writing log parsing errors from multiple
    input files
  - Fixed city lookups ignoring the City database when a Country database was
    listed first
  - Fixed geolocation maps appearing grey after restoring persisted city data
  - Fixed .gz file extensions being interpreted as macros in the man page
  - Fixed iOS version parsing from user-agent strings
  - Fixed unique visitor undercounting caused by collisions between reversed
    data and visitor key pairs
  - Fixed WebSocket payload size checks for large and fragmented messages
  - Grouped Lynx, Links, ELinks, w3m and Chawan under a new "Text-based"
    browser category
  - Reduced storage memory usage by about 20% and parsing time by about 35%


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.21-1
changelog:
  - Update to 1.9.21
  - Security fix: CVE-2026-41054 — privilege escalation via command socket
  - Fix semaphore error handling (SEM_FAILED vs NULL)
  - Fix /dev/shm permissions (use 01777 with sticky bit)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-1
changelog:
  - Update to 1.9.23
  - Security: use O_EXCL with sem_open to prevent semaphore pre-planting attacks
  - Security: fix OOB memory access in safein()/safeout() on socket errors
  - Security: reject command socket connections from different user namespaces
  - Security: use O_NOFOLLOW for PID file to prevent symlink attacks
  - Harden: open random device with O_CLOEXEC, restrict semaphore to 0600
  - Fix stale semaphore recovery after SIGKILL
  - Fix compilation when NO_COMMAND_MODE is defined


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-2
changelog:
  - Add SELinux policy module to allow semaphore creation in /dev/shm
  - Add rpminspect.yaml to waive pre-existing annocheck false positive


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-3
changelog:
  - Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
    (annocheck is a security inspection and cannot be disabled via inspections section)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.24-1
changelog:
  - Update to 1.9.24
  - Disable command mode in long-running service (--no-command flag)
  - Enable PrivateNetwork=true in systemd service
  - Remove SELinux policy module (no longer needed without command mode)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.25-1
changelog:
  - Update to 1.9.25
  - Fix initramfs switch-root failure caused by --no-command (BZ#2491739)
  - Add haveged-initramfs.service for use inside the initramfs


author: Filipe Rosset <filiperosset@fedoraproject.org> - 5.4.3-1
changelog:
  - update to 5.4.3 fixes rhbz#2492868
  - a bunch of other bugs were fixed and will be backported to all supported
    Fedora / EPEL versions


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-8
changelog:
  - Drop EL-7 support
    - Drop mod_geoip support
    - Drop mod_wrap support
    - Always build mod_proxy
    - Always use libpcre2
    - Always use maridb client library in preference to mysql
    - Always use libpq client library in preference to postgresql
    - Always use OpenSSL Cipher Profiles
  - Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
    onwards


author: Paul Howarth <paul@city-fan.org> - 1.3.9-0.1.rc2
changelog:
  - Update to 1.3.9rc2
    - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
    - Fix mod_sftp not advertising standard extensions for protocol version 3
      (GH#1570)
    - Fix mod_sftp "check-file" extension using wrong block size when offset and
      length are specified (GH#1569)
    - Use JSON for Controls protocol messages (GH#379)
    - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
    - Enforce requirement of preceding RewriteCondition for RewriteRule directives
      to avoid confusion (Bug #4495)
    - Implement LogFormat variable for data transfer average speed (GH#535)
    - Optimize per-connection file I/O when reading SFTPHostKey from disk
      (GH#1596)
    - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
      (GH#1610)
    - Reduce latency due to signal handling in the daemon process (GH#1623)
    - SSH key exchange requests should be classified into the "SEC" ExtendedLog
      class (GH#1626)
    - Update mod_exec to use the Jot API for resolving variables (GH#1630)
    - Use system TCP backlog value by default (GH#1636)
    - Gracefully handle directory creation requests when the directory already
      exists (GH#1639)
    - Remove asynchronous FTP responses emitted while computing digest values
      (GH#1661)
    - Support terminating connection after USER command when TLS is required
      (GH#1640)
    - Support OPTS commands for querying configured policy for resumed uploads,
      downloads (GH#1676)
    - MaxStoreFileSize for single user was not properly honored for SFTP uploads
      (GH#1686)
    - DisplayChdir using absolute path should work properly with DefaultRoot
      (GH#1688)
    - Clients should be disconnected when unable to be added to the
      ScoreboardFile (GH#1700)
    - Support injecting random delay when clients connect via DelayOnEvent
      (GH#1701)
    - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
    - Support obtaining default UID/GID values for AD directories in mod_ldap
      (GH#1716)
    - Update upload progress in scoreboard when throttling (GH#1433)
    - Null pointer reference encountered for FTPS connection due to config
      parser ignoring Include file problem (GH#1721)
    - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
    - mod_auth_otp should require per-user OTP entries by default (GH#1562)
    - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
      when using older OpenSSL versions (GH#1730)
    - Error resolving DNS name for implicit "server config" vhost lead to
      DelayTable not being found (GH#1746)
    - Log message for exceeding quota did not include the user/group/class quota
      type (GH#1749)
    - Build system failed for specific module names (GH#1756)
    - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
      (CVE-2023-48795, GH#1760)
  - Additional C compatibility fix


author: Paul Howarth <paul@city-fan.org> - 1.3.9-0.2.rc3
changelog:
  - Update to 1.3.9rc3
    - Bad handling of lack of extended attributes lead to SFTP out of memory
      error (GH#1785)
    - Using mod_facl and mod_vroot at same time caused unexpected permissions
      issues (GH#1780)
    - mod_sftp_sql logged "header value too long" due to unexpected key header
      text (GH#1529)
    - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
    - Implement limits@openssh.com SFTP extension (GH#1798)
    - Implement SFTPAuthPublicKeys directive for configuring the list of public
      key algorithms allowed for authentication (GH#1806)
    - Fix stack trace changing to directory with DisplayChdir file using %F
      variable on a large filesystem (GH#1819)
    - Remove inherited supplemental groups when started with root privileges
      (GH#1836)
    - SSH ECDSA host key algorithms were not being used as expected despite
      configuring appropriate key (GH#1839)
    - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
      (GH#1840)
    - Supplemental group inheritance granted unintended access to GID 0 due to
      lack of supplemental groups from mod_sql (GH#1830)


author: Paul Howarth <paul@city-fan.org> - 1.3.9-0.3.rc3
changelog:
  - Update mod_vroot to 0.9.12
    - Implement a realpath(3) callback for the FSIO API, for better
      interoperability of other modules when mod_vroot is in effect


author: Paul Howarth <paul@city-fan.org> - 1.3.9-1
changelog:
  - Update to 1.3.9
    - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
      unexpected behavior (GH#1855)
    - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
    - Added Polish translation (Bug #4511)
    - SFTP channel allocations can lead to high memory utilization over time
      (GH#1876)
    - Update libtool.m4 for better MacOSX support (GH#1878)
  - Update mod_proxy to 0.9.5
    - Implemented new IgnoreForeignAddress ProxyOption
    - Fixed passive data transfers to backend IPv4 address when IPv6 support is
      enabled


author: Paul Howarth <paul@city-fan.org> - 1.3.9a-1
changelog:
  - Update to 1.3.9a
    - SCP transfers failed for files with spaces in their names (GH#1886)
    - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
    - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
      option was used (Bug #4512)
    - mod_sftp failed to parse authorized user/host public keys with CRLF line
      endings (GH#1904)
    - Uploads using MODE Z sometimes resulted in corrupted files or broken
      transfers (GH#1896)
    - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
      versions (GH#1911)
    - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
    - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
    - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
      (GH#1964)
    - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
      (GH#1960)
    - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
      loop using newer OpenSSL versions (GH#1963)
    - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
      (GH#1984)
    - RNTO before authentication lead to out-of-order response codes (GH#2003)
    - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
      (GH#2009)
    - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
      (GH#2019)
    - Out-of-bounds single byte read when FTP command input buffer starts with LF
      (GH#2020)
    - FTP command LIST/NLST -B could cause buffer overflow when listing certain
      crafted filenames (GH#2030)
    - Memory exhaustion with mod_log_forensic when downloading very large files
      via SFTP (GH#2043)
    - Setting process groups during authentication crashed when using mod_radius
      and <IfGroup> (GH#2046)
    - SQL injection possible via mod_sql because of is_escaped_text() logic error
      (GH#2052, CVE-2026-42167)


author: Paul Howarth <paul@city-fan.org> - 1.3.9a-2
changelog:
  - Additional escaping for avoidance of SQL injection issues with %{note:...}
    and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
    1.3.9a
  - Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
    (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)


author: Paul Howarth <paul@city-fan.org> - 1.3.9b-1
changelog:
  - Update to 1.3.9b
    - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
      CVE-2026-44331)
    - Additional fix for session management with OpenSSL 3.2.x or later, when
      using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
    - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
      expected (GH#2098)
    - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
      in mod_sftp (GH#2102)
    - SSH packet with empty payload triggered null pointer dereference in
      mod_sftp (GH#2104)
    - Bad DSA signatures could lead to out-of-bounds read of heap memory in
      mod_sftp (GH#2106)
    - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
      mod_sftp (GH#2108)
    - SFTP request payload length underflow calculation in mod_sftp
      (GH#2115, CVE-2026-53994)
    - Several modules failed to build using OpenSSL 4.0 (GH#2120)
  - Update mod_proxy to 0.9.7
    - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
    - Set the payload_len field before checking its value (GH#292)
    - Keep the SSH packet reading code in mod_proxy more in line with what is
      done in mod_sftp, for legibility (GH#294)
    - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
      (GH#295, GH#296)
    - Correct misspellings noted by codespell (GH#297)
    - Use clang-tidy to start polishing the codebase (GH#298)
    - Disable the Nagle algorithm by default on our TCP connections to back-end
      servers (GH#299)
    - Require OpenSSL for building (GH#249, GH#300)
    - Documentation fixes
    - Implement a limit on the number of EXT_INFO extensions we'll be willing to
      accept (GH#303)
    - Comparison of expected/provided MAC data should be done in a constant-time
      manner
    - Support PKCS11-stored private keys
    - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
      post-quantum SSH key exchange mechanisms (GH#306)
    - Add sanity check for SRV record lengths
    - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
      does not underflow
    - If we detect a bad DSA signature length, properly error out
    - Ensure that RSA/DSA signatures match their expected algorithm types, and
      avoid null pointer dereferences
    - Update to build against OpenSSL 4.x (GH#313)


author: Paul Howarth <paul@city-fan.org> - 1.3.9c-1
changelog:
  - Update to 1.3.9c
    - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
    - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
    - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
    - AdminControlsACLs for config, get actions not honored as they should be
      (GH#2163)
    - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
      buffers without bounds checking (GH#2166)
    - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
      to reject illegal characters (GH#2173)
    - SQL group name lookup concatenates client-provided group names without
      escaping (GH#2188)
    - Authenticated SFTP sessions can overflow the SFTP packet buffer
      (GH#2190, CVE-2026-63090)
    - Default Controls socket ACLs unintentionally allow all users access for
      sending Controls requests (GH#2210)
    - Exercise caution when reading the client-provided file size for SCP
      uploads, as it could possibly overflow our size type (CVE-2026-63091)


author: Paul Howarth <paul@city-fan.org> - 1.3.9c-3
changelog:
  - Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
    /proc/self/root path prefix); this module disallows file accesses via procfs
    filesystems


