Summary
FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.
Security Fix(es):
* freeradius: forgery attack (CVE-2024-3596)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | freeradius | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-devel | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-doc | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-krb5 | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-ldap | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-mysql | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-perl | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-postgresql | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-rest | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-sqlite | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-unixODBC | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | freeradius-utils | 3.0.21-40.el9_4 |
| AlmaLinux · 9 | python3-freeradius | 3.0.21-40.el9_4 |
Vulnerabilities 1
-
Critical 9.0
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…