Summary
[3.0.13-10]
- Fixes two EAP-PWD security issues
Resolves: bz#1699413 authentication bypass with an invalid curve attack
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | freeradius | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-devel | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-doc | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-krb5 | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-ldap | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-mysql | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-perl | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-postgresql | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-python | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-sqlite | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-unixODBC | 0:3.0.13-10.el7_6 |
| Oracle Linux · 7 | freeradius-utils | 0:3.0.13-10.el7_6 |
Vulnerabilities 2
-
Unscored —
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a s…
-
Unscored —
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that…