Red Hat Security AdvisoryRHSA-2020:3984
freeradius security and bug fix update
Released 2020-09-29 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7) freeradius-3.0.13-15.el7
- Red Hat Enterprise Linux Server Optional (v. 7) freeradius-devel-3.0.13-15.el7, freeradius-devel-3.0.13-15.el7.ppc, freeradius-doc-3.0.13-15.el7 +9
- Red Hat Enterprise Linux Workstation (v. 7) freeradius-3.0.13-15.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) freeradius-devel-3.0.13-15.el7, freeradius-doc-3.0.13-15.el7, freeradius-krb5-3.0.13-15.el7 +8
Fixes 3 records
Priority HIGH 66
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by trickin…
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00345 · Published 2019-05-24 · Partial fix CWE-250
Priority LOW 37
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02222 · Published 2020-03-21 · Fixed CWE-662
Priority LOW 32
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop.
CVSS 3.1MEDIUM 6.5· Adjacent network · No auth · No interaction · EPSS 0.01798 · Published 2019-12-03 · Fixed CWE-203
THREATIST.IORead the docs