UpHeron
All vulnerabilities

Servers and applications

CVE-2019-19269

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.

Severity
Medium 4.9
Published
30 Nov 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.6% in the next 30 daysHigher than 76% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
ProFTPDServers and applications · cpe:a:proftpd:proftpd
  • Version 1.3.6
  • Version 1.3.6-rc4
  • Version 1.3.6-rc3
  • Version 1.3.6-rc2
All 8 release lines
  • Every version up to 1.3.5e
  • Version 1.3.6-alpha
  • Version 1.3.6-beta
  • Version 1.3.6-rc1
  • Version 1.3.6-rc2
  • Version 1.3.6-rc3
  • Version 1.3.6-rc4
  • Version 1.3.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-19269
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-19269