Moderate: freeradius security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-17185: In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack. 1816680: CVE-2019-17185 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access CVE-2019-13456: An information leak was discovered in the implementation of EAP-pwd in freeradius. An attacker could initiate several EAP-pwd handshakes to leak information, which can then be used to recover the user's WiFi password by performing dictionary and brute-force attacks. 1737663: CVE-2019-13456 freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations CVE-2019-10143: It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. 1705340: CVE-2019-10143 freeradius: privilege escalation due to insecure logrotate configuration