Bug 922145

Summary: update proftpd in EPEL
Product: [Fedora] Fedora EPEL Reporter: Till Maas <opensource>
Component: proftpdAssignee: Matthias Saou <matthias>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: el6CC: matthias, opensource, paul
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-07-04 07:37:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Till Maas 2013-03-15 15:08:07 UTC 
Description of problem:
EPEL 6 provides only proftpd-1.3.3g, but the 1.3.3 release is not supported by upstream anymore:
http://www.proftpd.org/

Therefore please consider to update proftpd to 1.3.4c.
Comment 1 Paul Howarth 2013-03-15 16:18:29 UTC 
Well that is true but 1.3.4 is quite a significant update from 1.3.3, which might introduce regressions from current behaviour, which is discouraged in EPEL.

I'll need a bit more convincing to do an EPEL update I think, having backported a recent security fix to 1.3.3g myself.
Comment 2 Till Maas 2013-07-04 07:37:16 UTC 
(In reply to Paul Howarth from comment #1)
> Well that is true but 1.3.4 is quite a significant update from 1.3.3, which
> might introduce regressions from current behaviour, which is discouraged in
> EPEL.
> 
> I'll need a bit more convincing to do an EPEL update I think, having
> backported a recent security fix to 1.3.3g myself.

In general it seems that EPEL lacks the manpower to backport security fixes, which is why I would feel safer if an upstream supported version was used. Then the migration could be done when it fits into ones schedule instead of when it becomes urgent because of an security issue. But since you would backport fixes I close this bug.