packages/net/vsftpd/patches, branch master

vsftpd: update to 3.0.4

2021-06-02T09:00:26Z

Switch to AUTORELEASE for simplicity. Signed-off-by: Rosen Penev

treewide: Run refresh on all packages

2021-02-21T00:02:15Z

The crude loop I wrote to come up with this changeset: find -L package/feeds/packages/ -name patches | \ sed 's/patches$/refresh/' | sort | xargs make Signed-off-by: Ilya Lipnitskiy

vsftpd: Fix compilation without ECC or deprecated APIs

2018-11-24T02:18:03Z

Signed-off-by: Rosen Penev

vsftpd: update to 3.0.3

2015-08-17T19:21:23Z

Update vsftpd to 3.0.3 released in July 2015. Changelog: https://security.appspot.com/vsftpd/Changelog.txt Release blog: http://scarybeastsecurity.blogspot.fi/2015/07/vsftpd-303-released-and-horrors-of-ftp.html - Increase VSFTP_AS_LIMIT to 200MB; various reports. - Make the PWD response more RFC compliant; report from Barry Kelly . - Remove the trailing period from EPSV response to work around BT Internet issues; report from Tim Bishop . - Fix syslog_enable issues vs. seccomp filtering. Report from Michal Vyskocil . At least, syslogging seems to work on my Fedora now. - Allow gettimeofday() in the seccomp sandbox. I can't repro failures, but I probably have a different distro / libc / etc. and there are multiple reports. - Some kernels support PR_SET_NO_NEW_PRIVS but not PR_SET_SECCOMP, so handle this case gracefully. Report from Vasily Averin . - List the TLS1.2 cipher AES128-GCM-SHA256 as first preference by default. - Make some compile-time SSL defaults (such as correct client shutdown handling) stricter. - Disable Nagle algorithm during SSL data connection shutdown, to avoid 200ms delays. From Tim Kosse . - Kill the FTP session if we see HTTP protocol commands, to avoid cross-protocol attacks. A report from Jann Horn . - Kill the FTP session if we see session re-use failure. A report from Tim Kosse . (vsftpd-3.0.3pre1) - Enable ECDHE, Tim Kosse . - Default cipher list is now just ECDHE-RSA-AES256-GCM-SHA384. - Minor SSL logging improvements. - Un-default tunable_strict_ssl_write_shutdown again. We still have tunable_strict_ssl_read_eof defaulted now, which is the important one to prove upload integrity. Signed-off-by: Hannu Nyman

[packages] vsftpd: CVE-2015-1419 Unspecified vulnerability in vsftp 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.

2015-06-28T20:02:08Z

vsftpd: fix musl compatibility

2015-06-16T18:50:04Z

Make vsftpd to compile with musl, while preserving uclibc compatibility. When using musl: * disable UTMPX functionality * disable -lnsl option in upstream Makefile Signed-off-by: Hannu Nyman

vsftpd: import from oldpackages. No changes.

2014-07-21T16:40:36Z