Skip to content
OpenAdvisories
High ELSA-2017-1581 1 CVE

Important: freeradius security update (Oracle Linux 7)

Published Jun 28, 2017 · Updated Jun 28, 2017

Ecosystem: Oracle Linux

Summary

[3.0.4-8]
- Disable internal OpenSSL cache and fix session cache file permissions.
Resolves: Bug#1459131 CVE-2017-9148 freeradius: TLS resumption
authentication bypass

Fixed packages 12

ReleasePackageFixed in
Oracle Linux · 7 freeradius 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-devel 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-doc 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-krb5 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-ldap 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-mysql 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-perl 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-postgresql 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-python 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-sqlite 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-unixODBC 0:3.0.4-8.el7_3
Oracle Linux · 7 freeradius-utils 0:3.0.4-8.el7_3

Vulnerabilities 1

  • Unscored —
    CVE-2017-9148

    The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before…

    freeradius Debian