# changelog

author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.94-1
changelog:
  - New version
    Resolves: rhbz#1842590
  - Used Exim maintainers keyring for GPG verification
  - Dropped CVE-2020-12783 patch (upstreamed)
  - Used better workaround for rhbz#1791878
    Resolves: rhbz#1842633


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.97.1-1
changelog:
  - New version
    Resolves: rhbz#2256145
  - Fixed SMTP smuggling vulnerability
    Resolves: CVE-2023-51766


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.98-1
changelog:
  - New version
    Resolves: rhbz#2297124
  - Fixed incorrect parsing of multiline rfc2231 header filename
    Resolves: CVE-2024-39929


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.98.1-1
changelog:
  - New version
    Resolves: rhbz#2346977
  - Fixed possible remote SQL injection
    Resolves: CVE-2025-26794
  - Updated exim maintainers keyring


author: Custom Build <admin@voyeta.com> - 4.99.1-2
changelog:
  - Enabled ARC (Authenticated Received Chain) support via EXPERIMENTAL_ARC=yes
  - Updated config patch to uncomment EXPERIMENTAL_ARC and SUPPORT_SRS in EDITME


author: Paul Howarth <paul@city-fan.org> - 1.3.7b-1
changelog:
  - Update to 1.3.7b
    - Fixed occasional segfaults with FTPS data transfers using TLSv1.3, when
      session tickets could not be decrypted (GH#1063)
    - Passive transfers failed unexpectedly due to use of SO_REUSEPORT socket
      option (GH#1171)
    - Implemented support for Redis 6.x AUTH semantics (GH#1070)
    - Fixed memory use-after-free issue in mod_sftp, which could cause unexpected
      login/authentication issues
    - Fixed SQL syntax regression for some generated SQL statements (GH#1149)
    - Fixed "Corrupted MAC on input" errors when SFTP uses the
      umac-64@openssh.com digest (GH#1111)


author: Paul Howarth <paul@city-fan.org> - 1.3.7c-1
changelog:
  - Update to 1.3.7c
    - Improve mod_tls log messages for unsupported older TLS protocol requests
      (GH#1273)
    - Fix memory disclosure to RADIUS servers by mod_radius (GH#1284)
    - Properly handle <VirtualHost> sections that use interface/device names
      (GH#1282)
    - PCRE expressions with capture groups are not being handled properly
      (GH#1300)
    - AuthUserFile permissions check fails during SIGHUP, causing ProFTPD to
      stop (GH#1307)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.1.rc2
changelog:
  - Update to 1.3.8rc2
    - mod_sftp crashes when handling aes256-ctr OpenSSH-specific key with some
      old OpenSSL versions (Bug #4401)
    - mod_ifsession failed to reset directory config lookup after <Directory>
      section merges (Bug #4315)
    - Support <Limit> configurations for HELP command (GH#1296)
    - Add support for the libidn2 library, over libidn, for e.g. mod_rewrite
      mappings (GH#1286)
    - Changed the default behaviour of mod_tls, such that TLS renegotiations on
      control/data connections are not requested by default - TLS renegotiations
      have a long and sordid history; many SSL/TLS libraries no longer implement
      them, or disable them by default (Bug #4443)
    - mod_auth_otp should honor RequireTableEntry semantics for SFTP logins
      (GH#1319)
  - Build with libidn2 support
  - Drop support for EOL distributions prior to EL-7
    - Always use systemd and assume preset support
    - %{rundir} is always /run
    - Use systemd scriptlet macros from systemd-rpm-macros
    - Always use libmemcached
    - Use %license unconditionally
  - Fix use of deprecated check APIs (GH#1262)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.2.rc3
changelog:
  - Update to 1.3.8rc3
    - Support SSH hostkey rotation via OpenSSH extensions (GH#1323)
    - NLST did not behave consistently for relative paths (GH#1325)
    - Support AES Galois Counter Mode (AES-GCM) in SSH; support for the
      "aes128-gcm@openssh.com" and "aes256-gcm@openssh.com" ciphers has been
      added to mod_sftp (Bug #3759)
    - Implement an LDAPConnectTimeout directive, to configure the timeout used
      when connecting to LDAP servers (GH#1333)
    - Implement OpenSSH "Encrypt-Then-MAC" (ETM) algorithm extensions (GH#1330)
    - Implement AllowForeignAddress class matching for passive data transfers
      (GH#1346)
    - Implement support for PCRE2 (GH#1353)
    - ProFTPD wouldn't start with several locales (Bug #4466)
    - Auth sources providing space-bearing user/group names caused compliance
      issues with MLSD/MLST responses (GH#1367)
    - DeleteAbortedStores removed successfully transferred files unexpectedly
      (Bug #4467)
    - Omit EPRT/EPSV from FEAT response when denied by <Limit> configuration
      (GH#1383)
    - Support uploading to symlinked files (GH#1379)
    - Keepalive socket options should be set using IPPROTO_TCP, not SOL_SOCKET
      (GH#1401)
    - TCP keepalive SocketOptions should apply to control as well as data
      connection (GH#1402)
    - ProFTPD always used the same PassivePorts port for first transfer (GH#1396)
    - mod_sftp needs to handle unknown SSH messages in an RFC-compliant manner,
      ignoring rather than disconnecting (GH#1410)
    - Improve handling of some globally applied configuration directives (GH#1418)
    - Name-based virtual hosts not working as expected after upgrade from 1.3.7a
      to 1.3.7b (GH#1369)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.3.rc4
changelog:
  - Update to 1.3.8rc4
    - mod_sftp should fail on startup when SFTP and TLS are both enabled for a
      vhost (GH#1434)
    - DelayTable not properly using documented default value; this is a
      regression caused by the changes for Bug#4020 (GH#1440)
    - Support customizing SSH ciphers, digests, key exchanges via SFTPClientMatch
      (GH#1444)
    - Ensure that mod_sftp algorithms work properly with OpenSSL 3.x (GH#1448)
    - BanOnEvent BadProtocol triggers segfault (GH#1445)
    - SFTP "check-file" implementation computes incorrect results (GH#1439)
    - Implement SFTPHostKeys directive for configuring the SSH host key
      algorithms (GH#1457)
    - Implement the "curve448-sha512" SSH key exchange algorithm (GH#1437)
    - Include directive broken when using wildcards for directory components
      (GH#1472)
    - mod_sftp fails to build using OpenSSL 1.0.x: undefined reference to
      'EVP_MD_CTX_reset' (Bug #4485)
    - Reload after omitting explicit ModulePath value causes fatal module load
      failures (GH#1476)
  - Drop pcre build dependency since we have been explicitly disabling it for the
    last 5 years anyway
  - Fix X448 support check to fail properly with OpenSSL 1.1.0 (GH#1488)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.4.rc4
changelog:
  - Update mod_vroot to 0.9.10
    - Fix unexpected filtering behaviour with mod_vroot (#2104972, GH#1491)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-1
changelog:
  - Update to 1.3.8
    - 1.3.8rc4 failed to build mod_sftp with OpenSSL 1.1.0 due to X448 check
      (GH#1488)
    - 1.3.8rc4 failed to build on Solaris due to missing type declarations
      (GH#1494)
    - mod_ifsession doesn't change the effect of SFTPMaxChannels (GH#1500)
    - mod_tls module unexpectedly allows TLS handshake after authentication in
      some configurations (GH#1533)
    - Disable FSCachePolicy by default (GH#1528)
    - Avoid logging "session closed" messages unless there is a corresponding
      "session opened" log message, to avoid user confusion (GH#1539)
    - Implement support for the CSID FTP command (GH#1550)
    - Unable to verify signed data: signature type 'rsa-sha2-512' does not match
      publickey algorithm 'ssh-rsa' (Bug #4491)
    - mod_auth_otp improperly allows keyboard-interactive logins for users
      lacking OTP entries (GH#1560)
  - Update mod_vroot to 0.9.11
    - Addresses a bad interaction with mod_auth_file, and failed login attempts,
      which can lead to inexplicably "stuck" processes that cannot be terminated
      (https://github.com/proftpd/proftpd/issues/1384)
  - Use SPDX-format license tag


