From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Paul Howarth To: git-commits@fedoraproject.org Subject: [rpms/proftpd] epel8: Address another avenue for SQL injection, via custom SQLUserInfo queries Date: Tue, 28 Jul 2026 18:05:57 GMT Message-ID: <178526195742.1.7443372548154956158.rpms-proftpd-7ed196d17f18@fedoraproject.org> List-ID: X-Git-Repo: rpms/proftpd X-Git-Branch: epel8 X-Git-Rev: 7ed196d17f1869e55f9c2acbcd1025e96c5848a7 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvcHJvZnRwZAogICAgICAgICAgICBCcmFuY2ggOiBlcGVsOAogICAgICAgICAg ICBDb21taXQgOiA3ZWQxOTZkMTdmMTg2OWU1NWY5YzJhY2JjZDEwMjVlOTZjNTg0OGE3CiAgICAg ICAgICAgIEF1dGhvciA6IFBhdWwgSG93YXJ0aCA8cGF1bEBjaXR5LWZhbi5vcmc+CiAgICAgICAg ICAgIERhdGUgICA6IDIwMjYtMDctMjdUMTY6MjE6NTgrMDE6MDAKICAgICAgICAgICAgU3RhdHMg IDogKzQxLy01IGluIDMgZmlsZShzKQogICAgICAgICAgICBVUkwgICAgOiBodHRwczovL3NyYy5m ZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL3Byb2Z0cGQvYy83ZWQxOTZkMTdmMTg2OWU1NWY5YzJhY2Jj ZDEwMjVlOTZjNTg0OGE3P2JyYW5jaD1lcGVsOAoKICAgICAgICAgICAgTG9nOgogICAgICAgICAg ICBBZGRyZXNzIGFub3RoZXIgYXZlbnVlIGZvciBTUUwgaW5qZWN0aW9uLCB2aWEgY3VzdG9tIFNR TFVzZXJJbmZvIHF1ZXJpZXMKCmh0dHBzOi8vZ2l0aHViLmNvbS9wcm9mdHBkL3Byb2Z0cGQvaXNz dWVzLzIwNTIjaXNzdWVjb21tZW50LTQ0ODkxMTA1OTgKCi0tLQpkaWZmIC0tZ2l0IGEvLmdpdGln bm9yZSBiLy5naXRpZ25vcmUKaW5kZXggNjk3YTFiYS4uNmEwMzU2OSAxMDA2NDQKLS0tIGEvLmdp dGlnbm9yZQorKysgYi8uZ2l0aWdub3JlCkBAIC0xLDEyICsxLDEzIEBACi0jIHJhd2hpZGUvZjQ0 L2Y0My9mNDIvZXBlbDEwCi0jIG5vdGU6IHRoZSB2MC45LjUudGFyLmd6IGlzIG1vZF9wcm94eQot L3Byb2Z0cGQtMS4zLjlhLnRhci5negorIyByYXdoaWRlL2Y0NC9mNDMvZXBlbDEwCisvcHJvZnRw ZC0xLjMuOWMudGFyLmd6CiAvdjAuOS4xMi50YXIuZ3oKLS92MC45LjUudGFyLmd6CisvdjAuOS43 LnRhci5negorL3YwLjIudGFyLmd6CiAjIGVwZWw5CiAvcHJvZnRwZC0xLjMuOGQudGFyLmd6CiAv djAuOS4xMS50YXIuZ3oKIC92MC45LjQudGFyLmd6CisvdjAuMi50YXIuZ3oKICMgZXBlbDgKICMg bm90ZTogdGhlIHYwLjkuNS50YXIuZ3ogaXMgbW9kX3Zyb290CiAvcHJvZnRwZC0xLjMuNmUudGFy Lmd6CgpkaWZmIC0tZ2l0IGEvMWE1Y2U2NDYucGF0Y2ggYi8xYTVjZTY0Ni5wYXRjaApuZXcgZmls ZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5lNGE3MTY4Ci0tLSAvZGV2L251bGwKKysrIGIv MWE1Y2U2NDYucGF0Y2gKQEAgLTAsMCArMSwyNyBAQAorRnJvbSAxYTVjZTY0Njc3NTZlOTJmNDJm ODljNTNmMGYzNzBkYzBmMDIwNmQ3IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTogVEog U2F1bmRlcnMgPHRqQGNhc3RhZ2xpYS5vcmc+CitEYXRlOiBUdWUsIDE5IE1heSAyMDI2IDA4OjAx OjExIC0wNzAwCitTdWJqZWN0OiBbUEFUQ0hdIElzc3VlICMyMDUyOiBBZGRyZXNzIGFub3RoZXIg YXZlbnVlIGZvciBTUUwgaW5qZWN0aW9uLCB2aWEKKyBjdXN0b20gU1FMVXNlckluZm8gcXVlcmll cy4KKworLS0tCisgY29udHJpYi9tb2Rfc3FsLmMgfCA1ICsrKystCisgMSBmaWxlIGNoYW5nZWQs IDQgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQorCitkaWZmIC0tZ2l0IGEvY29udHJpYi9t b2Rfc3FsLmMgYi9jb250cmliL21vZF9zcWwuYworaW5kZXggYjkwNzI1OTQyLi5kMjhiNDgzZDEg MTAwNjQ0CistLS0gYS9jb250cmliL21vZF9zcWwuYworKysrIGIvY29udHJpYi9tb2Rfc3FsLmMK K0BAIC0xOTk5LDggKzE5OTksMTEgQEAgc3RhdGljIHN0cnVjdCBwYXNzd2QgKnNxbF9nZXRwYXNz d2QoY21kX3JlYyAqY21kLCBzdHJ1Y3QgcGFzc3dkICpwKSB7CisgICAgICAgfQorIAorICAgICB9 IGVsc2UgeworKyAgICAgIC8qIFRoZSB1c2VybmFtZSBoYXMgYmVlbiBlc2NhcGVkIGFjY29yZGlu ZyB0byB0aGUgYmFja2VuZCBkYXRhYmFzZScgcnVsZXMKKysgICAgICAgKiBhdCB0aGlzIHBvaW50 LgorKyAgICAgICAqLworICAgICAgIG1yID0gc3FsX2xvb2t1cChzcWxfbWFrZV9jbWQoY21kLT50 bXBfcG9vbCwgMywgTU9EX1NRTF9ERUZfQ09OTl9OQU1FLAorLSAgICAgICAgY21hcC51c2VyY3Vz dG9tLCByZWFsbmFtZSA/IHJlYWxuYW1lIDogIk5VTEwiKSk7CisrICAgICAgICBjbWFwLnVzZXJj dXN0b20sIHVzZXJuYW1lID8gdXNlcm5hbWUgOiAiTlVMTCIpKTsKKyAKKyAgICAgICBpZiAoY2hl Y2tfcmVzcG9uc2UobXIsIDApIDwgMCkgeworICAgICAgICAgcmV0dXJuIE5VTEw7CgpkaWZmIC0t Z2l0IGEvcHJvZnRwZC5zcGVjIGIvcHJvZnRwZC5zcGVjCmluZGV4IGQyODE5ZWMuLjhiN2E3YjIg MTAwNjQ0Ci0tLSBhL3Byb2Z0cGQuc3BlYworKysgYi9wcm9mdHBkLnNwZWMKQEAgLTY2LDcgKzY2 LDcgQEAKICV1bmRlZmluZSBfc3RyaWN0X3N5bWJvbF9kZWZzX2J1aWxkCiAKICNnbG9iYWwgcHJl dmVyIHJjMwotJWdsb2JhbCBiYXNlcmVsZWFzZSAxMAorJWdsb2JhbCBiYXNlcmVsZWFzZSAxMQog JWdsb2JhbCBtb2RfdnJvb3RfdmVyc2lvbiAwLjkuNQogCiBTdW1tYXJ5OgkJRmxleGlibGUsIHN0 YWJsZSBhbmQgaGlnaGx5LWNvbmZpZ3VyYWJsZSBGVFAgc2VydmVyCkBAIC0xMDYsNiArMTA2LDcg QEAgUGF0Y2gxMTc6CQlwcm9mdHBkLTEuMy42ZS1idWc0MzA3LnBhdGNoCiBQYXRjaDExODoJCXBy b2Z0cGQtMS4zLjZlLWlzc3VlMTg0MC5wYXRjaAogUGF0Y2gxMTk6CQlodHRwczovL2dpdGh1Yi5j b20vcHJvZnRwZC9wcm9mdHBkL2NvbW1pdC8wNzc5N2FiYS5wYXRjaAogUGF0Y2gxMjA6CQlodHRw czovL2dpdGh1Yi5jb20vcHJvZnRwZC9wcm9mdHBkL2NvbW1pdC81ZTA2YWNjNC5wYXRjaAorUGF0 Y2gxMjE6CQlodHRwczovL2dpdGh1Yi5jb20vcHJvZnRwZC9wcm9mdHBkL2NvbW1pdC8xYTVjZTY0 Ni5wYXRjaAogCiBCdWlsZFJlcXVpcmVzOgkJY29yZXV0aWxzCiBCdWlsZFJlcXVpcmVzOgkJZ2Nj CkBAIC0zODIsNiArMzgzLDkgQEAgbXYgY29udHJpYi9SRUFETUUgY29udHJpYi9SRUFETUUuY29u dHJpYgogc2VkIC1pIC1lICcvXltbOnNwYWNlOl1dKlRMU0NpcGhlclN1aXRlW1s6c3BhY2U6XV0q UFJPRklMRT1TWVNURU0kL2QnIG1vZF90bHMuY29uZgogJWVuZGlmCiAKKyMgQWRkcmVzcyBhbm90 aGVyIGF2ZW51ZSBmb3IgU1FMIGluamVjdGlvbiwgdmlhIGN1c3RvbSBTUUxVc2VySW5mbyBxdWVy aWVzCislcGF0Y2ggLVAgMTIxIC1wMQorCiAlaWYgJXt1c2Vfc3lzdGVtZH0KICMgVHdlYWsgbG9n cm90YXRlIHNjcmlwdCBmb3Igc3lzdGVtZCBjb21wYXRpYmlsaXR5ICgjODAyMTc4KQogc2VkIC1p IC1lICcva2lsbGFsbC9zL3Rlc3QuKi9zeXN0ZW1jdGwgcmVsb2FkIHByb2Z0cGQuc2VydmljZS8n IFwKQEAgLTY2NCw2ICs2NjgsMTAgQEAgZmkKICV7X21hbmRpcn0vbWFuMS9mdHB3aG8uMSoKIAog JWNoYW5nZWxvZworKiBNb24gSnVsIDI3IDIwMjYgUGF1bCBIb3dhcnRoIDxwYXVsQGNpdHktZmFu Lm9yZz4gLSAxLjMuNmUtMTEKKy0gQWRkcmVzcyBhbm90aGVyIGF2ZW51ZSBmb3IgU1FMIGluamVj dGlvbiwgdmlhIGN1c3RvbSBTUUxVc2VySW5mbyBxdWVyaWVzCisgIChodHRwczovL2dpdGh1Yi5j b20vcHJvZnRwZC9wcm9mdHBkL2lzc3Vlcy8yMDUyI2lzc3VlY29tbWVudC00NDg5MTEwNTk4KQor CiAqIE1vbiBNYXkgMTEgMjAyNiBQYXVsIEhvd2FydGggPHBhdWxAY2l0eS1mYW4ub3JnPiAtIDEu My42ZS0xMAogLSBGaXggZm9yIFNRTCBJbmplY3Rpb24gaW4gbW9kX3dyYXAyX3NxbCB2aWEgcmV2 ZXJzZSBETlMgaG9zdG5hbWUKICAgKENWRS0yMDI2LTQ0MzMxLCByaGJ6IzI0NjY4OTksIGh0dHBz Oi8vZ2l0aHViLmNvbS9wcm9mdHBkL3Byb2Z0cGQvaXNzdWVzLzIwNTcpCg==