openSUSE Security Update : freeradius-server (openSUSE-2020-553)

This update for freeradius-server fixes the following issues : - CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd bsc1144524. - CVE-2019-17185: Fixed a debial of service due to multithreaded BNCTX access bsc1166847. - Fixed an issue in TLS-EAP where the OCSP verification, when an...

openSUSE: Security Advisory for freeradius-server (openSUSE-SU-2020:0553-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0553-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd bsc1144524. - CVE-2019-17185: Fixed a debial of service due to multithreaded BNCTX access bsc1166847. - Fixed an issue in TLS-EAP where the OCSP verification, when an...

Security update for freeradius-server (moderate)

openSUSE Security Update: Security update for freeradius-server Announcement ID: openSUSE-SU-2020:0553-1 Rating: moderate References: 1144524 1146848 1166847 Cross-References: CVE-2019-13456 CVE-2019-17185 Affected Products: openSUSE Leap 15.1 An update that solves two vulnerabilities and has one...

Security update for freeradius-server (important)

openSUSE Security Update: Security update for freeradius-server Announcement ID: openSUSE-SU-2020:0542-1 Rating: important References: 1132549 1132664 Cross-References: CVE-2019-11234 CVE-2019-11235 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2020:1018-1)

This update for freeradius-server fixes the following issues : CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd bsc1144524. CVE-2019-17185: Fixed a debial of service due to multithreaded BNCTX access bsc1166847. Fixed an issue in TLS-EAP where the OCSP verification, when an...

SUSE SLED15 / SLES15 Security Update : freeradius-server (SUSE-SU-2020:1023-1)

This update for freeradius-server fixes the following issues : CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd bsc1144524. CVE-2019-17185: Fixed a debial of service due to multithreaded BNCTX access bsc1166847. Fixed an issue in TLS-EAP where the OCSP verification, when an...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2020:1020-1)

This update for freeradius-server fixes the following issues : CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd bsc1144524. CVE-2019-17185: Fixed a debial of service due to multithreaded BNCTX access bsc1166847. Note that Tenable Network Security has extracted the preceding descripti...

SUSE-SU-2020:1023-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd bsc1144524. - CVE-2019-17185: Fixed a debial of service due to multithreaded BNCTX access bsc1166847. - Fixed an issue in TLS-EAP where the OCSP verification, when an...

SUSE-SU-2020:1018-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd bsc1144524. - CVE-2019-17185: Fixed a debial of service due to multithreaded BNCTX access bsc1166847. - Fixed an issue in TLS-EAP where the OCSP verification, when an...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Information Disclosure

jboss EAP is vulnerable to information disclosure. The RHSA-2008:0826 update fixed an issue CVE-2008-3273 where unauthenticated users were able to access the status servlet; however, a bug fix included in the RHSA-2009:0347 update re-introduced the issue. A remote attacker could use this flaw to...

Information Disclosure

jbossws is vulnerable to information disclosure. The request handler in JBossWS did not correctly verify the resource path when serving WSDL files for custom web service endpoints. This allowed remote attackers to read arbitrary XML files with the permissions of the EAP processs...

Information Disclosure

JBoss EAP is vulnerable to Information Disclosure. Authenticated users were able to access the status servlet, which could allow remote attackers to acquire details about deployed web contexts...

CVE-2020-8597

A buffer overflow flaw was found in the ppp package in versions 2.4.2 through 2.4.8. The bounds check for the rhostname was improperly constructed in the EAP request and response functions which could allow a buffer overflow to occur. Data confidentiality and integrity, as well as system...

CVE-2019-9499

A flaw was found in wpasupplicant. An attack using invalid scalar/element values is possible against the EAP-pwd peer since hostapd and wpasupplicant did not validate these values in the received EAP-pwd-Commit messages.When processing an EAP-pwd Commit frame, the server's scalar and element...

CVE-2019-9497

The implementations of EAP-PWD in hostapd EAP Server and wpasupplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not...

CVE-2017-2595

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal...

CVE-2020-9428

An out-of-bounds read was discovered in Wireshark in the EAP dissector. An attacker can trigger the flaw by injecting special packets onto the wire or by convincing a victim user into opening a malformed packet trace file...

CVE-2019-17185

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BNCTX instance to handle all handshakes. This mean multiple threads use the same BNCTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a...