CVE-2016-3125

The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.

• CWE-254
• CWE-310

• http://bugs.proftpd.org/show_bug.cgi?id=4230Issue Tracking
• http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179109.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179143.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179905.html
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00080.html
• http://lists.opensuse.org/opensuse-updates/2016-06/msg00045.htmlThird Party Advisory
• http://proftpd.org/docs/NEWS-1.3.5bRelease Notes
• http://proftpd.org/docs/NEWS-1.3.6rc2Release Notes
• http://www.openwall.com/lists/oss-security/2016/03/11/14Mailing List
• http://www.openwall.com/lists/oss-security/2016/03/11/3Mailing List
• http://bugs.proftpd.org/show_bug.cgi?id=4230Issue Tracking
• http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179109.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179143.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179905.html
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00080.html
• http://lists.opensuse.org/opensuse-updates/2016-06/msg00045.htmlThird Party Advisory
• http://proftpd.org/docs/NEWS-1.3.5bRelease Notes
• http://proftpd.org/docs/NEWS-1.3.6rc2Release Notes
• http://www.openwall.com/lists/oss-security/2016/03/11/14Mailing List
• http://www.openwall.com/lists/oss-security/2016/03/11/3Mailing List

Published

Apr 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3115Multiple CRLF injection vulnerabilities in session.c in sshd…6.4
• CVE-2016-3116CRLF injection vulnerability in Dropbear SSH before 2016.72 …
• CVE-2016-3118CRLF injection vulnerability in CA API Gateway (formerly Lay…
• CVE-2016-3119The process_db_args function in plugins/kdb/ldap/libkdb_ldap…
• CVE-2016-3120The validate_as_request function in kdc_util.c in the Key Di…
• CVE-2016-3124The sanitycheck module in SimpleSAMLphp before 1.14.1 allows…
• CVE-2016-3126Cross-site scripting (XSS) vulnerability in the Management C…
• CVE-2016-3127An information disclosure vulnerability in the logging imple…
• CVE-2016-3128A spoofing vulnerability in the Core of BlackBerry Enterpris…
• CVE-2016-3129A remote shell execution vulnerability in the BlackBerry Goo…
• CVE-2016-3130An information disclosure vulnerability in the Core and Mana…
• CVE-2016-3131Cloudera CDH before 5.6.1 allows authorization bypass via di…6.5