Re: tnftpd 20231001 released

[Thomas Klausner <wiz%gatalith.at@localhost>]

On Sun, Oct 01, 2023 at 05:50:56PM +1100, Luke Mewburn wrote:
> I've released tnftpd 20231001.
> 
> Changes in tnftpd from 20200704 to 20231001:
> 
>         Security fixes to improve error handling when switching UID/GID,
>         and to prevent MLSD and MLST before authentication succeeds.
> 
>         Fix buffer overflows when counting users, and when authenticating
>         using PAM.

Are any of these important enough that we should have an entry in pkg-vulnerabilities about them?

> The pkgsrc package net/tnftpd should be updated.

I've just done that.
 Thomas