When rebasing pure-ftpd in Fedora 26, 27 and Rawhide, a packaging error occurred due to which the original configuration was ignored after update and service started running with default configuration. This has security implications because of overriding security-related configuration as well.

This issue is Fedora-specific and affected Fedora 26, 27 and Rawhide. The affected downstream version is pure-ftpd-1.0.46-1.

A flaw was found in the way that the Mantis BTS handled attachments and MIME types. A user could upload an HTML file renamed to a .gif and Mantis would calculate the actual MIME type of the file as text/html. A user tricked into thinking they were clicking a .gif attachment would instead have the full HTML file rendered in the browser, rather than having it treated as a downloadable file or displayed in plain text.

References:

http://www.mantisbt.org/bugs/view.php?id=11952 http://www.mantisbt.org/blog/?p=113

This was corrected in upstream version 1.2.2 and affects current Fedora 12, 13, rawhide, and EPEL5.