# changelog

author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-2
changelog:
  - mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
    required for VirtualHost matching.


author: Tim College <tcollege@interworx.com>
changelog:
  - Add editor-launch: suid helper to open a multi-line CLI field in a fixed
    editor as the account user, replacing the runasuser path for that use.
    Ships with the CLI package since that is the only caller (IWX-14992)


author: Nathan Roth <nroth@interworx.com>
changelog:
  - Stop shipping dovecot-sql.conf.ext; InterWorx writes iworx-vpopmail-dovecot-sql.conf.ext at install time
  - Remove legacy /etc/dovecot/dovecot-sql.conf.ext on upgrade


author: Brandon L. Locke <blocke@liquidweb.com> - 1.0
changelog:
  - Initial overlay package: AWL enable, spamd 127.0.0.1 bind, and
    InterWorx MySQL LD_LIBRARY_PATH for the distro SpamAssassin.


author: Nathan Roth <nroth@interworx.com>
changelog:
  - Add Requires(pre) dependency on interworx-unix-users-vpopmail for horde and iworx packages to ensure vchkpw group exists


author: Brandon Locke <blocke@liquidweb.com>
changelog:
  - Add spamassassin subpackage providing the spamd user/group for the
    interworx-spamassassin overlay


author: Remi Collet <remi@remirepo.net> - 8.2.28-1
changelog:
  - Update to 8.2.28 - http://www.php.net/releases/8_2_28.php
  - use oracle client library version 23.7 on x86_64 and arm64


author: Remi Collet <remi@remirepo.net> - 15.5.0~beta-1
changelog:
  - update to 15.5.0 Beta (November 11, 2025)
  - open https://support.ioncube.com/index.php?/Tickets/Ticket/View/YFF-156-91044
    undefined symbol: zend_constant_add_attributes


author: Remi Collet <remi@remirepo.net> - 1.10.17-2
changelog:
  - remove report_memleaks usage with PHP 8.5 using patch from
    https://github.com/pear/pear-core/pull/164


author: Remi Collet <remi@remirepo.net> - 1.0.9-1
changelog:
  - update to 1.0.9
  - drop patch merged upstream
  - re-license spec file to CECILL-2.1
  - add pie virtual provides


author: Paul Howarth <paul@city-fan.org> - 1.3.8c-1
changelog:
  - Update to 1.3.8c
    - Using FTPS after upgrading from 1.3.8a to 1.3.8b lead to crash (GH#1770)
    - Bad handling of lack of extended attributes lead to SFTP out of memory
      error (GH#1785)
    - mod_sftp_sql logged "header value too long" due to unexpected key header
      text (GH#1529)
    - SSH ECDSA host key algorithms were not used as expected despite configuring
      appropriate key (GH#1839)
    - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
      (GH#1840)
    - Supplemental group inheritance granted unintended access to GID 0 due to
      lack of supplemental groups from mod_sql (GH#1830)


author: Paul Howarth <paul@city-fan.org> - 1.3.8c-2
changelog:
  - Fixes for C23 compatibility
  - Update mod_vroot to 0.9.12
    - Implement a realpath(3) callback for the FSIO API, for better
      interoperability of other modules when mod_vroot is in effect


author: Paul Howarth <paul@city-fan.org> - 1.3.8c-3
changelog:
  - Avoid NULL pointer dereferences in mod_ls (CVE-2024-57392)
    - https://github.com/proftpd/proftpd/issues/1866
  - Add explicit BR: libxcrypt-devel


author: Paul Howarth <paul@city-fan.org> - 1.3.8d-1
changelog:
  - Update to 1.3.8d
    - Use of HideNoAccess for SFTP sessions can lead to segfault and/or
      unexpected behaviour (GH#1855)
    - SFTP channel allocations can lead to high memory utilization over time
      (GH#1876)
    - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)


author: Paul Howarth <paul@city-fan.org> - 1.3.9-1
changelog:
  - Update to 1.3.9 (see RELEASE_NOTES for details)
  - Update mod_proxy to 0.9.5
    - Implemented new IgnoreForeignAddress ProxyOption
    - Fixed passive data transfers to backend IPv4 address when IPv6 support is
      enabled


author: Paul Howarth <paul@city-fan.org> - 1.3.9a-1
changelog:
  - Update to 1.3.9a
    - SCP transfers failed for files with spaces in their names (GH#1886)
    - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
    - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
      option was used (Bug #4512)
    - mod_sftp failed to parse authorized user/host public keys with CRLF line
      endings (GH#1904)
    - Uploads using MODE Z sometimes resulted in corrupted files or broken
      transfers (GH#1896)
    - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
      versions (GH#1911)
    - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
    - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
    - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
      (GH#1964)
    - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
      (GH#1960)
    - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
      loop using newer OpenSSL versions (GH#1963)
    - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
      (GH#1984)
    - RNTO before authentication lead to out-of-order response codes (GH#2003)
    - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
      (GH#2009)
    - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
      (GH#2019)
    - Out-of-bounds single byte read when FTP command input buffer starts with LF
      (GH#2020)
    - FTP command LIST/NLST -B could cause buffer overflow when listing certain
      crafted filenames (GH#2030)
    - Memory exhaustion with mod_log_forensic when downloading very large files
      via SFTP (GH#2043)
    - Setting process groups during authentication crashed when using mod_radius
      and <IfGroup> (GH#2046)
    - SQL injection possible via mod_sql because of is_escaped_text() logic error
      (GH#2052, CVE-2026-42167)


author: Paul Howarth <paul@city-fan.org> - 1.3.9a-2
changelog:
  - Additional escaping for avoidance of SQL injection issues with %{note:...}
    and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
    1.3.9a
  - Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
    (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)


author: Paul Howarth <paul@city-fan.org> - 1.3.9b-1
changelog:
  - Update to 1.3.9b
    - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
      CVE-2026-44331)
    - Additional fix for session management with OpenSSL 3.2.x or later, when
      using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
    - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
      expected (GH#2098)
    - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
      in mod_sftp (GH#2102)
    - SSH packet with empty payload triggered null pointer dereference in
      mod_sftp (GH#2104)
    - Bad DSA signatures could lead to out-of-bounds read of heap memory in
      mod_sftp (GH#2106)
    - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
      mod_sftp (GH#2108)
    - SFTP request payload length underflow calculation in mod_sftp (GH#2115)
    - Several modules failed to build using OpenSSL 4.0 (GH#2120)
  - Update mod_proxy to 0.9.7
    - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
    - Set the payload_len field before checking its value (GH#292)
    - Keep the SSH packet reading code in mod_proxy more in line with what is
      done in mod_sftp, for legibility (GH#294)
    - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
      (GH#295, GH#296)
    - Correct misspellings noted by codespell (GH#297)
    - Use clang-tidy to start polishing the codebase (GH#298)
    - Disable the Nagle algorithm by default on our TCP connections to back-end
      servers (GH#299)
    - Require OpenSSL for building (GH#249, GH#300)
    - Documentation fixes
    - Implement a limit on the number of EXT_INFO extensions we'll be willing to
      accept (GH#303)
    - Comparison of expected/provided MAC data should be done in a constant-time
      manner
    - Support PKCS11-stored private keys
    - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
      post-quantum SSH key exchange mechanisms (GH#306)
    - Add sanity check for SRV record lengths
    - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
      does not underflow
    - If we detect a bad DSA signature length, properly error out
    - Ensure that RSA/DSA signatures match their expected algorithm types, and
      avoid null pointer dereferences
    - Update to build against OpenSSL 4.x (GH#313)


author: Brandon Locke <blocke@liquidweb.com> - 1.3.9b-1
changelog:
  - Add Patch106 (proftpd-1.3.9b-mod_tls-openssl10-sslsession.patch) to fix EL7
    build failure: tls_end_sess() calls 1.1-only SSL_SESSION_up_ref()
    unconditionally (added upstream in 1.3.9b for Issue #2056), which fails to
    link against system OpenSSL 1.0.2 on EL7


author: jpurkis <jpurkis@interworx.com>
changelog:
  - Update makecert.sh to use 2048 bit keys
  - Update makecert.sh to use SHA256
  - Regen certs on install


author: Nathan Roth <nroth@interworx.com>
changelog:
  - Add Dovecot domain alias map generation (bug #14179)
  - New vwrite_dovecot_map() function generates /home/vpopmail/etc/dovecot_domain_map
  - Automatically updates map when domains/aliases are added or modified
  - Security: O_EXCL prevents symlink attacks, atomic file updates via rename
  - Security: Explicit 0644 permissions bypass umask, stale temp file cleanup
  - Logs errors and warnings to syslog with LOG_MAIL facility
  - Added vupdate-dovecot utility for manual map regeneration (EL8+)


