CVE-2019-19270: An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b.

Security readout for executives and security teams

ProFTPD through 1.3.6b may fail to honor some certificate revocation lists during TLS client-certificate checks. A client certificate that should have been blocked could still be accepted. This matters most where ProFTPD uses certificate revocation as an access-control boundary. Exposure is likely limited to ProFTPD servers through 1.3.6b that use TLS client certificates and depend on CRLs to revoke client access. Servers not using client-certificate CRL validation are not shown as exposed by the supplied sources. Treat as a targeted access-control risk, not a broad internet-wide emergency based on supplied evidence. Give it priority where revoked certificates are used to remove partner, customer, or privileged access to ProFTPD services. Mitigation focus: Identify ProFTPD deployments at or below version 1.3.6b.; Check Fedora, openSUSE, upstream ProFTPD, or vendor package guidance for fixed builds.; Prioritize systems using TLS client certificates and CRL-based revocation..

Prepared

Jun 6, 2026, 12:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.