CVE-2016-3125

NONE EPSS 93.4%

Published Apr 5, 201610y ago · Modified Jun 17, 20262w ago

Published Apr 5, 2016 10y ago

Last Modified Jun 17, 2026 2w ago

Description

The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.

Threat Intelligence

EPSS Exploit Probability

93.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-254

CWE-310

Affected Products 5

Vendor	Product	Version	Range
proftpd	proftpd	*	≤1.3.5
proftpd	proftpd	1.3.6	any
opensuse	opensuse	13.1	any
fedoraproject	fedora	22	any
fedoraproject	fedora	23	any

References 10

bugs.proftpd.org http://bugs.proftpd.org/show_bug.cgi?id=4230

Issue Tracking
lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179109.html

Third Party Advisory
lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179143.html

Third Party Advisory
lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179905.html
lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-05/msg00080.html
lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-06/msg00045.html

Third Party Advisory
proftpd.org http://proftpd.org/docs/NEWS-1.3.5b

Release Notes
proftpd.org http://proftpd.org/docs/NEWS-1.3.6rc2

Release Notes
openwall.com http://www.openwall.com/lists/oss-security/2016/03/11/14

Mailing List
openwall.com http://www.openwall.com/lists/oss-security/2016/03/11/3

Mailing List

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.