Medium ELSA-2023-2166 3 CVEs

Moderate: freeradius security and bug fix update (Oracle Linux 9)

Published May 15, 2023 · Updated May 15, 2023

Ecosystem: Oracle Linux

Summary

[3.0.21-37]
- Fix defect found by covscan
Resolves: #2151705

[3.0.21-36]
- Fix multiple CVEs
Resolves: #2151705
Resolves: #2151703
Resolves: #2151707

[3.0.21-35]
- Rebuild to add subpackages to CRB report
Resolves: #2126380

Fixed packages 13

Release	Package	Fixed in
Oracle Linux · 9	freeradius	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-devel	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-doc	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-krb5	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-ldap	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-mysql	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-perl	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-postgresql	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-rest	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-sqlite	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-unixODBC	0:3.0.21-37.el9
Oracle Linux · 9	freeradius-utils	0:3.0.21-37.el9
Oracle Linux · 9	python3-freeradius	0:3.0.21-37.el9

Vulnerabilities 3

High 7.5

CVE-2022-41859

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an att…

freeradius freeradius freeradius Debian Ubuntu Alpine

Jan 17, 2023
High 7.5

CVE-2022-41860

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in th…

freeradius freeradius freeradius freeradius Debian Ubuntu Azure Linux Alpine

Jan 17, 2023
Medium 6.5

CVE-2022-41861

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which c…

freeradius freeradius freeradius freeradius Debian Ubuntu Azure Linux Alpine

Jan 17, 2023