freeradius security update

2017-06-2800:00:00

linux.oracle.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.3%

JSON

[3.0.4-8]

Disable internal OpenSSL cache and fix session cache file permissions.
Resolves: Bug#1459131 CVE-2017-9148 freeradius: TLS resumption
authentication bypass

OSVersionArchitecturePackageVersionFilename
oracle linux7srcfreeradius< 3.0.4-8.el7_3freeradius-3.0.4-8.el7_3.src.rpm
oracle linux7x86_64freeradius< 3.0.4-8.el7_3freeradius-3.0.4-8.el7_3.x86_64.rpm
oracle linux7i686freeradius-devel< 3.0.4-8.el7_3freeradius-devel-3.0.4-8.el7_3.i686.rpm
oracle linux7x86_64freeradius-devel< 3.0.4-8.el7_3freeradius-devel-3.0.4-8.el7_3.x86_64.rpm
oracle linux7x86_64freeradius-doc< 3.0.4-8.el7_3freeradius-doc-3.0.4-8.el7_3.x86_64.rpm
oracle linux7x86_64freeradius-krb5< 3.0.4-8.el7_3freeradius-krb5-3.0.4-8.el7_3.x86_64.rpm
oracle linux7x86_64freeradius-ldap< 3.0.4-8.el7_3freeradius-ldap-3.0.4-8.el7_3.x86_64.rpm
oracle linux7x86_64freeradius-mysql< 3.0.4-8.el7_3freeradius-mysql-3.0.4-8.el7_3.x86_64.rpm
oracle linux7x86_64freeradius-perl< 3.0.4-8.el7_3freeradius-perl-3.0.4-8.el7_3.x86_64.rpm
oracle linux7x86_64freeradius-postgresql< 3.0.4-8.el7_3freeradius-postgresql-3.0.4-8.el7_3.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	7	src	freeradius	< 3.0.4-8.el7_3	freeradius-3.0.4-8.el7_3.src.rpm
oracle linux	7	x86_64	freeradius	< 3.0.4-8.el7_3	freeradius-3.0.4-8.el7_3.x86_64.rpm
oracle linux	7	i686	freeradius-devel	< 3.0.4-8.el7_3	freeradius-devel-3.0.4-8.el7_3.i686.rpm
oracle linux	7	x86_64	freeradius-devel	< 3.0.4-8.el7_3	freeradius-devel-3.0.4-8.el7_3.x86_64.rpm
oracle linux	7	x86_64	freeradius-doc	< 3.0.4-8.el7_3	freeradius-doc-3.0.4-8.el7_3.x86_64.rpm
oracle linux	7	x86_64	freeradius-krb5	< 3.0.4-8.el7_3	freeradius-krb5-3.0.4-8.el7_3.x86_64.rpm
oracle linux	7	x86_64	freeradius-ldap	< 3.0.4-8.el7_3	freeradius-ldap-3.0.4-8.el7_3.x86_64.rpm
oracle linux	7	x86_64	freeradius-mysql	< 3.0.4-8.el7_3	freeradius-mysql-3.0.4-8.el7_3.x86_64.rpm
oracle linux	7	x86_64	freeradius-perl	< 3.0.4-8.el7_3	freeradius-perl-3.0.4-8.el7_3.x86_64.rpm
oracle linux	7	x86_64	freeradius-postgresql	< 3.0.4-8.el7_3	freeradius-postgresql-3.0.4-8.el7_3.x86_64.rpm