Skip to content
OpenAdvisories
High ELSA-2024-4936 1 CVE

Important: freeradius:3.0 security update (Oracle Linux 8)

Published Jul 31, 2024 · Updated Jul 31, 2024

Ecosystem: Oracle Linux

Summary

[3.0.20-15]
- Backport BlastRADIUS CVE fix
Resolves: RHEL-46572

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 8 freeradius 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-devel 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-doc 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-krb5 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-ldap 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-mysql 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-perl 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-postgresql 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-rest 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-sqlite 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-unixODBC 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 freeradius-utils 0:3.0.20-15.module+el8.10.0+90375+641abe33
Oracle Linux · 8 python3-freeradius 0:3.0.20-15.module+el8.10.0+90375+641abe33

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine