[rpms/proftpd] f44: Update to 1.3.9c

[rpms/proftpd] f44: Update to 1.3.9c

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/proftpd
            Branch : f44
            Commit : d1fd54013af4ff7a99c2b2ea0670d97f10c16bb1
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-09T08:57:37+01:00
            Stats  : +21/-5 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/proftpd/c/d1fd54013af4ff7a99c2b2ea0670d97f10c16bb1?branch=f44

            Log:
            Update to 1.3.9c

- New upstream release 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer (GH#2190)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)

---
diff --git a/.gitignore b/.gitignore
index 7eeea01..2754037 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,5 @@
 # rawhide/f44/f43/epel10
-/proftpd-1.3.9a.tar.gz
+/proftpd-1.3.9c.tar.gz
 /v0.9.12.tar.gz
 /v0.9.7.tar.gz
 # epel9
@@ -9,4 +9,3 @@
 # epel8
 /proftpd-1.3.6e.tar.gz
 /v0.9.5.tar.gz
-/proftpd-1.3.9b.tar.gz

diff --git a/proftpd.spec b/proftpd.spec
index 335b44d..8336bb3 100644
--- a/proftpd.spec
+++ b/proftpd.spec
@@ -17,13 +17,13 @@
 %undefine _strict_symbol_defs_build
 
 #global prever rc4
-%global baserelease 2
+%global baserelease 1
 %global mod_proxy_version 0.9.7
 %global mod_vroot_version 0.9.12
 
 Summary:		Flexible, stable and highly-configurable FTP server
 Name:			proftpd
-Version:		1.3.9b
+Version:		1.3.9c
 Release:		%{?prever:0.}%{baserelease}%{?prever:.%{prever}}%{?dist}
 License:		GPL-2.0-or-later
 URL:			http://www.proftpd.org/
@@ -461,6 +461,23 @@ fi
 %{_mandir}/man1/ftpwho.1*
 
 %changelog
+* Wed Jul  8 2026 Paul Howarth <paul@city-fan.org> - 1.3.9c-1
+- Update to 1.3.9c
+  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
+  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
+  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
+  - AdminControlsACLs for config, get actions not honored as they should be
+    (GH#2163)
+  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
+    buffers without bounds checking (GH#2166)
+  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
+    to reject illegal characters (GH#2173)
+  - SQL group name lookup concatenates client-provided group names without
+    escaping (GH#2188)
+  - Authenticated SFTP sessions can overflow the SFTP packet buffer (GH#2190)
+  - Default Controls socket ACLs unintentionally allow all users access for
+    sending Controls requests (GH#2210)
+
 * Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1.3.9b-2
 - Rebuilt for openssl 4.0
 

diff --git a/sources b/sources
index 3354efa..e22e3a5 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (proftpd-1.3.9b.tar.gz) = bfcfe013db3b93247abacd2fd8fb2d929feede4e7f804a2416ca161c5cc1a3a4a18e1cc5914ae6536ebc2f40da69c1713a65c1317a3a8cbfe63706709f2e4dec
+SHA512 (proftpd-1.3.9c.tar.gz) = b5003a02af58281cbad73edd4de81848c27def76cec88b1d234c32f1d04a5c8aa54cf08958815d5a927280fb2c6973df6f04209731bc92eee0f8f635e5e3aa5b
 SHA512 (v0.9.12.tar.gz) = a84c14b9d05c4890abe50c86f832c91fa4d0971bc2b1866a3a34d73ff85acd1e902fc0cae739e22ea46e530c73230fb005ea9edeb68fd6cfb963e0c5ca9655ec
 SHA512 (v0.9.7.tar.gz) = 9979dc21ebebf5f219303769cebd73be9ab66ae7f50756fa12bdf37bcac1cdc9ac70feeb557ef16bb4bb3fcf8121aed4d16b6a0e5c0738bbcc53a0055410c3cd