From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Paul Howarth To: git-commits@fedoraproject.org Subject: [rpms/proftpd] epel9: Address another avenue for SQL injection, via custom SQLUserInfo queries Date: Tue, 28 Jul 2026 17:52:32 GMT Message-ID: <178526115201.1.2433900620810417136.rpms-proftpd-44bc5cb74fc8@fedoraproject.org> List-ID: X-Git-Repo: rpms/proftpd X-Git-Branch: epel9 X-Git-Rev: 44bc5cb74fc8bd72740143787cd5831fe57764e1 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvcHJvZnRwZAogICAgICAgICAgICBCcmFuY2ggOiBlcGVsOQogICAgICAgICAg ICBDb21taXQgOiA0NGJjNWNiNzRmYzhiZDcyNzQwMTQzNzg3Y2Q1ODMxZmU1Nzc2NGUxCiAgICAg ICAgICAgIEF1dGhvciA6IFBhdWwgSG93YXJ0aCA8cGF1bEBjaXR5LWZhbi5vcmc+CiAgICAgICAg ICAgIERhdGUgICA6IDIwMjYtMDctMjJUMTQ6NTM6MTIrMDE6MDAKICAgICAgICAgICAgU3RhdHMg IDogKzM2Ly0xIGluIDIgZmlsZShzKQogICAgICAgICAgICBVUkwgICAgOiBodHRwczovL3NyYy5m ZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL3Byb2Z0cGQvYy80NGJjNWNiNzRmYzhiZDcyNzQwMTQzNzg3 Y2Q1ODMxZmU1Nzc2NGUxP2JyYW5jaD1lcGVsOQoKICAgICAgICAgICAgTG9nOgogICAgICAgICAg ICBBZGRyZXNzIGFub3RoZXIgYXZlbnVlIGZvciBTUUwgaW5qZWN0aW9uLCB2aWEgY3VzdG9tIFNR TFVzZXJJbmZvIHF1ZXJpZXMKCmh0dHBzOi8vZ2l0aHViLmNvbS9wcm9mdHBkL3Byb2Z0cGQvaXNz dWVzLzIwNTIjaXNzdWVjb21tZW50LTQ0ODkxMTA1OTgKCi0tLQpkaWZmIC0tZ2l0IGEvMWE1Y2U2 NDYucGF0Y2ggYi8xYTVjZTY0Ni5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw MDAwLi5lNGE3MTY4Ci0tLSAvZGV2L251bGwKKysrIGIvMWE1Y2U2NDYucGF0Y2gKQEAgLTAsMCAr MSwyNyBAQAorRnJvbSAxYTVjZTY0Njc3NTZlOTJmNDJmODljNTNmMGYzNzBkYzBmMDIwNmQ3IE1v biBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTogVEogU2F1bmRlcnMgPHRqQGNhc3RhZ2xpYS5v cmc+CitEYXRlOiBUdWUsIDE5IE1heSAyMDI2IDA4OjAxOjExIC0wNzAwCitTdWJqZWN0OiBbUEFU Q0hdIElzc3VlICMyMDUyOiBBZGRyZXNzIGFub3RoZXIgYXZlbnVlIGZvciBTUUwgaW5qZWN0aW9u LCB2aWEKKyBjdXN0b20gU1FMVXNlckluZm8gcXVlcmllcy4KKworLS0tCisgY29udHJpYi9tb2Rf c3FsLmMgfCA1ICsrKystCisgMSBmaWxlIGNoYW5nZWQsIDQgaW5zZXJ0aW9ucygrKSwgMSBkZWxl dGlvbigtKQorCitkaWZmIC0tZ2l0IGEvY29udHJpYi9tb2Rfc3FsLmMgYi9jb250cmliL21vZF9z cWwuYworaW5kZXggYjkwNzI1OTQyLi5kMjhiNDgzZDEgMTAwNjQ0CistLS0gYS9jb250cmliL21v ZF9zcWwuYworKysrIGIvY29udHJpYi9tb2Rfc3FsLmMKK0BAIC0xOTk5LDggKzE5OTksMTEgQEAg c3RhdGljIHN0cnVjdCBwYXNzd2QgKnNxbF9nZXRwYXNzd2QoY21kX3JlYyAqY21kLCBzdHJ1Y3Qg cGFzc3dkICpwKSB7CisgICAgICAgfQorIAorICAgICB9IGVsc2UgeworKyAgICAgIC8qIFRoZSB1 c2VybmFtZSBoYXMgYmVlbiBlc2NhcGVkIGFjY29yZGluZyB0byB0aGUgYmFja2VuZCBkYXRhYmFz ZScgcnVsZXMKKysgICAgICAgKiBhdCB0aGlzIHBvaW50LgorKyAgICAgICAqLworICAgICAgIG1y ID0gc3FsX2xvb2t1cChzcWxfbWFrZV9jbWQoY21kLT50bXBfcG9vbCwgMywgTU9EX1NRTF9ERUZf Q09OTl9OQU1FLAorLSAgICAgICAgY21hcC51c2VyY3VzdG9tLCByZWFsbmFtZSA/IHJlYWxuYW1l IDogIk5VTEwiKSk7CisrICAgICAgICBjbWFwLnVzZXJjdXN0b20sIHVzZXJuYW1lID8gdXNlcm5h bWUgOiAiTlVMTCIpKTsKKyAKKyAgICAgICBpZiAoY2hlY2tfcmVzcG9uc2UobXIsIDApIDwgMCkg eworICAgICAgICAgcmV0dXJuIE5VTEw7CgpkaWZmIC0tZ2l0IGEvcHJvZnRwZC5zcGVjIGIvcHJv ZnRwZC5zcGVjCmluZGV4IDljZGY1ODQuLmMyYjQ4MTUgMTAwNjQ0Ci0tLSBhL3Byb2Z0cGQuc3Bl YworKysgYi9wcm9mdHBkLnNwZWMKQEAgLTM4LDcgKzM4LDcgQEAKICV1bmRlZmluZSBfc3RyaWN0 X3N5bWJvbF9kZWZzX2J1aWxkCiAKICNnbG9iYWwgcHJldmVyIHJjNAotJWdsb2JhbCBiYXNlcmVs ZWFzZSAzCislZ2xvYmFsIGJhc2VyZWxlYXNlIDQKICVnbG9iYWwgbW9kX3Byb3h5X3ZlcnNpb24g MC45LjQKICVnbG9iYWwgbW9kX3Zyb290X3ZlcnNpb24gMC45LjExCiAKQEAgLTcyLDYgKzcyLDcg QEAgUGF0Y2gyMToJCWh0dHBzOi8vZ2l0aHViLmNvbS9wcm9mdHBkL3Byb2Z0cGQvY29tbWl0LzA0 ZDg5OTU3LnBhdGNoCiBQYXRjaDIyOgkJaHR0cHM6Ly9naXRodWIuY29tL3Byb2Z0cGQvcHJvZnRw ZC9jb21taXQvN2UwNzZlODQucGF0Y2gKIFBhdGNoMjM6CQlodHRwczovL2dpdGh1Yi5jb20vcHJv ZnRwZC9wcm9mdHBkL2NvbW1pdC8wNzc5N2FiYS5wYXRjaAogUGF0Y2gyNDoJCWh0dHBzOi8vZ2l0 aHViLmNvbS9wcm9mdHBkL3Byb2Z0cGQvY29tbWl0LzVlMDZhY2M0LnBhdGNoCitQYXRjaDI1OgkJ aHR0cHM6Ly9naXRodWIuY29tL3Byb2Z0cGQvcHJvZnRwZC9jb21taXQvMWE1Y2U2NDYucGF0Y2gK IAogQnVpbGRSZXF1aXJlczoJCWNvcmV1dGlscwogQnVpbGRSZXF1aXJlczoJCWdjYwpAQCAtMzA2 LDYgKzMwNyw5IEBAIHNlZCAtaSAtZSAnL15bWzpzcGFjZTpdXSpUTFNDaXBoZXJTdWl0ZVtbOnNw YWNlOl1dKlBST0ZJTEU9U1lTVEVNJC9kJyBtb2RfdGxzLmNvCiAlcGF0Y2ggLVAgMjMgLXAxCiAl cGF0Y2ggLVAgMjQgLXAxCiAKKyMgQWRkcmVzcyBhbm90aGVyIGF2ZW51ZSBmb3IgU1FMIGluamVj dGlvbiwgdmlhIGN1c3RvbSBTUUxVc2VySW5mbyBxdWVyaWVzCislcGF0Y2ggLVAgMjUgLXAxCisK ICMgVHdlYWsgbG9ncm90YXRlIHNjcmlwdCBmb3Igc3lzdGVtZCBjb21wYXRpYmlsaXR5ICgjODAy MTc4KQogJWlmICgwJXs/cmhlbH0gJiYgMCV7P3JoZWx9IDw9IDcpIHx8ICgwJXs/ZmVkb3JhfSAm JiAwJXs/ZmVkb3JhfSA8PSAyMykKIHNlZCAtaSAtZSAnL2tpbGxhbGwvcy90ZXN0Liovc3lzdGVt Y3RsIHJlbG9hZCBwcm9mdHBkLnNlcnZpY2UvJyBcCkBAIC01NTIsNiArNTU2LDEwIEBAIGZpCiAl e19tYW5kaXJ9L21hbjEvZnRwd2hvLjEqCiAKICVjaGFuZ2Vsb2cKKyogV2VkIEp1bCAyMiAyMDI2 IFBhdWwgSG93YXJ0aCA8cGF1bEBjaXR5LWZhbi5vcmc+IC0gMS4zLjhkLTQKKy0gQWRkcmVzcyBh bm90aGVyIGF2ZW51ZSBmb3IgU1FMIGluamVjdGlvbiwgdmlhIGN1c3RvbSBTUUxVc2VySW5mbyBx dWVyaWVzCisgIChodHRwczovL2dpdGh1Yi5jb20vcHJvZnRwZC9wcm9mdHBkL2lzc3Vlcy8yMDUy I2lzc3VlY29tbWVudC00NDg5MTEwNTk4KQorCiAqIE1vbiBNYXkgMTEgMjAyNiBQYXVsIEhvd2Fy dGggPHBhdWxAY2l0eS1mYW4ub3JnPiAtIDEuMy44ZC0zCiAtIEFkZGl0aW9uYWwgZXNjYXBpbmcg Zm9yIGF2b2lkYW5jZSBvZiBTUUwgaW5qZWN0aW9uIGlzc3VlcyB3aXRoICUle25vdGU6Li4ufQog ICBhbmQgJSV7ZW52Oi4uLn07IHRoZXNlIGFyZSBvbiB0b3Agb2YgdGhlIGV4aXN0aW5nIGZpeCBm b3IgQ1ZFLTIwMjYtNDIxNjcgaW4K