[Git][security-tracker-team/security-tracker][master] bogus CVE on proftpd, the VulnCheck CNA is such a joke

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
82c60a9f by Moritz Muehlenhoff at 2026-02-09T17:30:56+01:00
bogus CVE on proftpd, the VulnCheck CNA is such a joke

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -6972,7 +6972,9 @@ CVE-2021-47867 (WIN-PACK PRO4.8 contains an unquoted service path vulnerability
 CVE-2021-47866 (WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in th ...)
 	NOT-FOR-US: WIN-PACK PRO
 CVE-2021-47865 (ProFTPD 1.3.7a contains a denial of service vulnerability that allows  ...)
-	TODO: check
+	NOTE: Bogus CVE assignment, obviously using more connections than available causes
+	NOTE: an exhaustion of available connections, but that's not a DoS...
+	NOTE: https://github.com/proftpd/proftpd/issues/1298
 CVE-2021-47864 (OSAS Traverse Extension 11 contains an unquoted service path vulnerabi ...)
 	NOT-FOR-US: OSAS Traverse Extension
 CVE-2021-47863 (MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/82c60a9f0f6cc679759c20d076501db928e094d7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/82c60a9f0f6cc679759c20d076501db928e094d7
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260209/9037d262/attachment.htm>