Summary
[3.0.21-40]
- Backport fixes for BlastRADIUS CVE
Resolves: RHEL-46566
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | freeradius | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-devel | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-doc | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-krb5 | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-ldap | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-mysql | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-perl | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-postgresql | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-rest | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-sqlite | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-unixODBC | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | freeradius-utils | 0:3.0.21-40.el9_4 |
| Oracle Linux · 9 | python3-freeradius | 0:3.0.21-40.el9_4 |
Vulnerabilities 1
-
Critical 9.0
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…