freeradius:3.0 security and bug fix update

3.0.20-3 - Require make for proper bootstrap execution, removes post script Resolves: bz1672285 3.0.20-2 - Fix breakage caused by OpenSSL FIPS regression Related: bz1855822 Related: bz1810911 Resolves: bz1672285 3.0.20-1 - Update to FreeRADIUS server version 3.0.20 - Introduce Python 3 support;...

Moderate: Red Hat Security Advisory: freeradius:3.0 security and bug fix update

An update for the freeradius:3.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Huawei EulerOS: Security Advisory for freeradius (EulerOS-SA-2020-2342)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 8 : freeradius:3.0 (RHSA-2020:4799)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4799 advisory. FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service RADIUS server, designed to allow centralized...

RLSA-2020:4799 Moderate: freeradius:3.0 security and bug fix update

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service RADIUS server, designed to allow centralized authentication and authorization for a network. Security Fixes: freeradius: eap-pwd: DoS issues due to multithreaded BNCTX access CVE-2019-17185 Fo...

Moderate: freeradius:3.0 security and bug fix update

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service RADIUS server, designed to allow centralized authentication and authorization for a network. Security Fixes: freeradius: eap-pwd: DoS issues due to multithreaded BNCTX access CVE-2019-17185 Fo...

freeradius:3.0 security and bug fix update

An update is available for freeradius. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRADIUS is a high-performance and highly configurable free Remote...

EulerOS 2.0 SP2 : freeradius (EulerOS-SA-2020-2342)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BNCTX instance to handle all handshakes. This mean multiple threads...

Amazon Linux 2 : freeradius (ALAS-2020-1515)

The version of freeradius installed on the remote host is prior to 3.0.13-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1515 advisory. It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has contro...

Medium: freeradius

Issue Overview: It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the...

Scientific Linux Security Update : freeradius on SL7.x x86_64 (20201001)

Security Fixes : - freeradius: privilege escalation due to insecure logrotate configuration CVE-2019-10143 - freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations CVE-2019-13456 - freeradius: eap-pwd: DoS issues due to multithreaded BNCTX access CVE-2019-17185...

freeradius security update

CentOS Errata and Security Advisory CESA-2020:3984 An update for freeradius is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

CentOS 7 : freeradius (RHSA-2020:3984)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3984 advisory. - It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has...

Oracle Linux 7 : freeradius (ELSA-2020-3984)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3984 advisory. 3.0.13-15 - Fixes EAP-PWD: DoS issues due to multithreaded BNCTX access Resolves: bz1818808 3.0.13-14 - Fixes receiving of multiple RADIUS packets unde...

freeradius security and bug fix update

3.0.13-15 - Fixes EAP-PWD: DoS issues due to multithreaded BNCTX access Resolves: bz1818808 3.0.13-14 - Fixes receiving of multiple RADIUS packets under load Resolves: bz1630684 3.0.13-13 - Fixes logging of cleartext pap password Resolves: bz1677435 3.0.13-12 - Fixes paircompare with attribute...

Information Leakage

FreeRADIUS is vulnerable to Information leak. It is possible due to aborting when needing more than 10 iterations...

Buffer Over-read

freeradius is heap-based buffer over-read. It is possible due to a flaw in multithreaded BNCTX access...

freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BNCTX instance to handle all handshakes. This mean multiple threads use the same BNCTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a...

freeradius: privilege escalation due to insecure logrotate configuration

It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user...

freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations

An information leak was discovered in the implementation of EAP-pwd in freeradius. An attacker could initiate several EAP-pwd handshakes to leak information, which can then be used to recover the user's WiFi password by performing dictionary and brute-force attacks...