CVE-2024-48651

Publication date 29 November 2024

Last updated 26 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
proftpd-dfsg	25.04 plucky	Not affected
	24.10 oracular	Fixed 1.3.8.b+dfsg-2ubuntu1.24.10.1
	24.04 LTS noble	Fixed 1.3.8.b+dfsg-1ubuntu0.1
	22.04 LTS jammy	Fixed 1.3.7c+dfsg-1ubuntu0.1
	20.04 LTS focal	Fixed 1.3.6c-2ubuntu0.1
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected

Notes

eslerm

not introduced until v1.3.7 with 678696c8db9fb8e33d444be8f59ea88b419b13ae

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

USN-7297-1
ProFTPD vulnerabilities
25 February 2025