Red Hat Security AdvisoryRHSA-2023:2166
freeradius security and bug fix update
Released 2023-05-09 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) freeradius-3.0.21-37.el9, freeradius-devel-3.0.21-37.el9, freeradius-doc-3.0.21-37.el9 +4
- Red Hat Enterprise Linux CRB (v. 9) freeradius-mysql-3.0.21-37.el9, freeradius-perl-3.0.21-37.el9, freeradius-postgresql-3.0.21-37.el9 +3
Fixes 3 records
Priority MEDIUM 41
In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01213 · Published 2023-01-17 · Partial fix CWE-476
Priority MEDIUM 41
In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-01-17 · Partial fix CWE-200
Priority LOW 31
A flaw was found in freeradius.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01143 · Published 2023-01-17 · Partial fix CWE-400
