Red Hat Security AdvisoryRHSA-2023:2870
freeradius:3.0 security update
Released 2023-05-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.aarch64::freeradius:3.0, freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.ppc64le::freeradius:3.0, freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.s390x::freeradius:3.0 +47
Fixes 3 records
Priority MEDIUM 41
In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01213 · Published 2023-01-17 · Partial fix CWE-476
Priority MEDIUM 41
In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-01-17 · Partial fix CWE-200
Priority LOW 31
A flaw was found in freeradius.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01143 · Published 2023-01-17 · Partial fix CWE-400
