Red Hat Security AdvisoryRHSA-2019:1131
freeradius security update
Released 2019-05-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7) freeradius-3.0.13-10.el7_6
- Red Hat Enterprise Linux Server Optional (v. 7) freeradius-devel-3.0.13-10.el7_6, freeradius-devel-3.0.13-10.el7_6.ppc, freeradius-doc-3.0.13-10.el7_6 +9
- Red Hat Enterprise Linux Workstation (v. 7) freeradius-3.0.13-10.el7_6
- Red Hat Enterprise Linux Workstation Optional (v. 7) freeradius-devel-3.0.13-10.el7_6, freeradius-doc-3.0.13-10.el7_6, freeradius-krb5-3.0.13-10.el7_6 +8
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) freeradius-3.0.13-10.el7_6
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) freeradius-devel-3.0.13-10.el7_6, freeradius-doc-3.0.13-10.el7_6, freeradius-krb5-3.0.13-10.el7_6 +8
Fixes 2 records
Priority MEDIUM 52
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07624 · Published 2019-04-21 · Fixed CWE-287
Priority MEDIUM 48
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dr…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03566 · Published 2019-04-21 · Fixed CWE-345
