Red Hat Security AdvisoryRHSA-2019:1142
freeradius:3.0 security update
Released 2019-05-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) freeradius-3.0.17-4.module+el8.0.0+3108+851cb559.aarch64::freeradius:3.0, freeradius-3.0.17-4.module+el8.0.0+3108+851cb559.ppc64le::freeradius:3.0, freeradius-3.0.17-4.module+el8.0.0+3108+851cb559.s390x::freeradius:3.0 +46
Fixes 2 records
Priority MEDIUM 52
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07624 · Published 2019-04-21 · Fixed CWE-287
Priority MEDIUM 48
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dr…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03566 · Published 2019-04-21 · Fixed CWE-345
