Handling of CVE-2026-35025

[Salvatore Bonaccorso]

Hi Hilmar,

On Sun, Jul 26, 2026 at 11:36:23PM +0200, Preuße, Hilmar wrote:
> Hello,
> 
> the CVE-2026-35025 is about a design flaw in proftp: not deny access to
> /proc file system.
> 
> The upstream maintainer of proftp refuses to do a code change for this in
> the proftp code. He instead provided a new module, which (if loaded) denies
> the access. The module has entered Debian last week. I would add this module
> to the Recommends line and then assume the issue to be solved.
> Not sure how to address the issue in Debian stable: proftp has internal
> methods to limit access to file systems by changing a config file.

Seen the upstream discussion and in fact I already marked the CVE in
the tracker as unimportant, with the following rationale:

Negligible impact, upstream does not want to make a special/edge case for /proc
access in core ProFTPD code. Instead a new mod_procfs module is introduced,
wich rejects commands which refer to paths in /proc, cf.
https://github.com/proftpd/proftpd/issues/2170#issuecomment-4998331303

That is technically the issue remains open in the source, but we can
mark it unimportant and shift it away from our attention needing
radar. so nothinger lese to be done here.

Cnversely I uess we want an update for the two recently eported CVEs,
but I have not found time yet to go into details there. In trixie
right now there are CVE-2026-44331, CVE-2026-53994, CVE-2026-63090 and
CVE-2026-63091 open.

Thanks for your work!

Regards,
Salvatore