Summary
[3.0.17-4]
- Fixes two EAP-PWD security issues
Resolves: bz#1699416 authentication bypass with an invalid curve attack
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | freeradius | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-devel | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-doc | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-krb5 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-ldap | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-mysql | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-perl | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-postgresql | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-rest | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-sqlite | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-unixODBC | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
| Oracle Linux · 8 | freeradius-utils | 0:3.0.17-4.module+el8.0.0+5208+733fb731 |
Vulnerabilities 2
-
Unscored —
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a s…
-
Unscored —
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that…