Skip to content
OpenAdvisories
High ALAS2-2019-1218 2 CVEs

Important: freeradius security update (Amazon Linux 2)

Published May 29, 2019 · Updated May 30, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11235: FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499. 1695748: CVE-2019-11235 freeradius: eap-pwd: authentication bypass via an invalid curve attack CVE-2019-11234: FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. 1695783: CVE-2019-11234 freeradius: eap-pwd: fake authentication using reflection

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2 freeradius 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-debuginfo 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-devel 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-doc 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-krb5 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-ldap 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-mysql 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-perl 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-postgresql 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-python 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-sqlite 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-unixODBC 0:3.0.13-10.amzn2
Amazon Linux · 2 freeradius-utils 0:3.0.13-10.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-11234.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-11235.html