Description
The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.5b-1 | — |
| Debian 13 | proftpd-dfsg | 1.3.5b-1 | — |
| Debian 12 | proftpd-dfsg | 1.3.5b-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | proftpd-dfsg | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | proftpd | 1.3.5b-2.5 | openSUSE-SU-2024:10048-1 |
Advisories 1
- openSUSE-SU-2024:10048-1 proftpd-1.3.5b-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openSUSE-SU-2016:1558 vendor-advisory
- FEDORA-2016-ac3587be9a vendor-advisory
- [oss-security] 20160311 Re: ProFTPD before 1.3.5b/1.3.6rc2 uses 1024 bit Diffie Hellman parameters for TLS even if user sets manual parameters mailing-list
- http://proftpd.org/docs/NEWS-1.3.6rc2
- FEDORA-2016-f95d8ea3ad vendor-advisory
- http://proftpd.org/docs/NEWS-1.3.5b
- FEDORA-2016-977d57cf2d vendor-advisory
- openSUSE-SU-2016:1334 vendor-advisory
- http://bugs.proftpd.org/show_bug.cgi?id=4230
- [oss-security] 20160311 ProFTPD before 1.3.5b/1.3.6rc2 uses 1024 bit Diffie Hellman parameters for TLS even if user sets manual parameters mailing-list