Red Hat Security AdvisoryRHSA-2017:2389
freeradius security update
Released 2017-08-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7) freeradius-3.0.13-8.el7_4
- Red Hat Enterprise Linux Server Optional (v. 7) freeradius-devel-3.0.13-8.el7_4, freeradius-devel-3.0.13-8.el7_4.ppc, freeradius-doc-3.0.13-8.el7_4 +9
- Red Hat Enterprise Linux Workstation (v. 7) freeradius-3.0.13-8.el7_4
- Red Hat Enterprise Linux Workstation Optional (v. 7) freeradius-devel-3.0.13-8.el7_4, freeradius-doc-3.0.13-8.el7_4, freeradius-krb5-3.0.13-8.el7_4 +8
Fixes 6 records
Priority MEDIUM 51
An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06414 · Published 2017-07-17 · Fixed CWE-787
Priority LOW 39
An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03268 · Published 2017-07-17 · Fixed CWE-835
Priority LOW 39
An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03381 · Published 2017-07-17 · Partial fix CWE-119
Priority LOW 39
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03806 · Published 2017-07-17 · Partial fix CWE-119
Priority LOW 38
An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02988 · Published 2017-07-17 · Fixed CWE-125
Priority LOW 38
An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02988 · Published 2017-07-17 · Partial fix CWE-835
THREATIST.IORead the docs