Skip to content
OpenAdvisories
High ELSA-2024-4911 1 CVE

Important: freeradius security update (Oracle Linux 7)

Published Sep 28, 2024 · Updated Sep 28, 2024

Ecosystem: Oracle Linux

Summary

[3.0.13-15.0.1]
- Fixes CVE-2024-3596 security issue [Orabug: 36904288]

Fixed packages 12

ReleasePackageFixed in
Oracle Linux · 7 freeradius 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-devel 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-doc 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-krb5 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-ldap 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-mysql 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-perl 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-postgresql 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-python 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-sqlite 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-unixODBC 0:3.0.13-15.0.1.el7
Oracle Linux · 7 freeradius-utils 0:3.0.13-15.0.1.el7

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine