CVE-2019-19269

Name of the Vulnerable Software and Affected Versions ProFTPD versions through 1.3.6b

Description An issue was discovered in the tls verify crl function. A dereference of a NULL pointer may occur when the OpenSSL sk X509 REVOKED value() function encounters an empty CRL installed by a system administrator. This issue happens during the validation of a client's certificate in a TLS client/server mutual-authentication setup.

Recommendations For ProFTPD versions through 1.3.6b, consider updating to a version that fixes the issue with the tls verify crl function to prevent the dereference of a NULL pointer. At the moment, there is no information about a newer version that contains a fix for this vulnerability.