Advisories » MGASA-2026-0200

Updated proftpd packages fix security vulnerabilities

Publication date: 12 Jun 2026
Modification date: 12 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-42167 , CVE-2026-44331

Description

CVE-2026-42167 mod_sql in ProFTPD before 1.3.9a allows remote attackers
to execute arbitrary code via a username, in scenarios where there is
logging of USER requests with an expansion such as %U, and the SQL
backend allows commands (e.g., COPY TO PROGRAM).
CVE-2026-44331 a SQL injection vulnerability in
sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote
attacker to inject arbitrary SQL commands via a crafted domain name that
is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled,
the attacker-supplied hostname is passed unescaped into SQL queries. The
character restrictions of DNS names may affect
                

References

• https://bugs.mageia.org/show_bug.cgi?id=35445
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEM6GPOFEILUHBP4D2KWIUHVXL5546WE/
• https://www.cve.org/CVERecord?id=CVE-2026-42167
• https://www.cve.org/CVERecord?id=CVE-2026-44331

SRPMS

9/core

• proftpd-1.3.8c-1.2.mga9