Skip to content
OpenAdvisories
Critical RHSA-2024:4874 1 CVE

Red Hat Security Advisory: freeradius:3.0 security update

Published Sep 16, 2024 · Updated Apr 23, 2026

Ecosystem: Red Hat

Fixed packages 75

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-debugsource 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-devel 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-doc 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-krb5 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-krb5-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-ldap 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-ldap-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-mysql 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-mysql-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-perl 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-perl-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-postgresql 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-postgresql-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-rest 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-rest-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-sqlite 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-sqlite-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-unixODBC 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-unixODBC-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-utils 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream freeradius-utils-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream python3-freeradius 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream python3-freeradius-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-debugsource 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-devel 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-doc 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-krb5 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-krb5-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-ldap 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-ldap-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-mysql 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-mysql-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-perl 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-perl-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-postgresql 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-postgresql-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-rest 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-rest-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-sqlite 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-sqlite-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-unixODBC 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-unixODBC-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-utils 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream freeradius-utils-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream python3-freeradius 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream python3-freeradius-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-debugsource 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-devel 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-doc 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-krb5 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-krb5-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-ldap 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-ldap-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-mysql 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-mysql-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-perl 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-perl-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-postgresql 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-postgresql-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-rest 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-rest-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-sqlite 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-sqlite-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-unixODBC 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-unixODBC-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-utils 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream freeradius-utils-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream python3-freeradius 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream python3-freeradius-debuginfo 0:3.0.20-4.module+el8.4.0+22088+2692c5cc.1

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263240
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4874.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-3596
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-3596
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-3596
  • article
    https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
  • article
    https://datatracker.ietf.org/doc/html/rfc2865
  • article
    https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf
  • article
    https://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt
  • article
    https://www.blastradius.fail/
  • advisory
    https://www.kb.cert.org/vuls/id/456537