Skip to content
OpenAdvisories
High ALAS2-2024-2611 1 CVE

Important: freeradius security update (Amazon Linux 2)

Published Aug 1, 2024 · Updated Aug 13, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2 freeradius 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-debuginfo 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-devel 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-doc 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-krb5 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-ldap 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-mysql 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-perl 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-postgresql 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-python 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-sqlite 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-unixODBC 0:3.0.27-1.amzn2.0.1
Amazon Linux · 2 freeradius-utils 0:3.0.27-1.amzn2.0.1

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-3596.html