Description
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| freeradius | freeradius | affects <= 3.0.19 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeradius | 3.2.6+dfsg-3 | — |
| Debian 13 | freeradius | 3.2.6+dfsg-3 | — |
| Debian 12 | freeradius | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | freeradius | No fix yet | — |
| Ubuntu 26.04 LTS | freeradius | No fix yet | — |
| Ubuntu 25.10 | freeradius | No fix yet | — |
| Ubuntu 24.04 LTS | freeradius | No fix yet | — |
| Ubuntu 22.04 LTS | freeradius | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | freeradius | No fix yet | — |
| Ubuntu 18.04 LTS | freeradius | No fix yet | — |
| Ubuntu Pro 16.04 LTS | freeradius | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | freeradius +11 | 3.0.17-6.module+el8.1.0+3392+9bd8939b | RHSA-2019:3353 |
| RHEL 7 | freeradius +11 | 3.0.13-15.el7 | RHSA-2020:3984 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | freeradius | 3.0.19-r3 | — |
| Alpine v3.23 | freeradius | 3.0.19-r3 | — |
| Alpine v3.22 | freeradius | 3.0.19-r3 | — |
| Alpine v3.21 | freeradius | 3.0.19-r3 | — |
| Alpine v3.20 | freeradius | 3.0.19-r3 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | freeradius | 3.0.19-r3 | — |
| Alpine v3.18 | freeradius | 3.0.19-r3 | — |
| Alpine v3.17 | freeradius | 3.0.19-r3 | — |
| Alpine v3.16 | freeradius | 3.0.19-r3 | — |
| Alpine v3.15 | freeradius | 3.0.19-r3 | — |
| Alpine v3.14 | freeradius | 3.0.19-r3 | — |
| Alpine v3.13 | freeradius | 3.0.19-r3 | — |
| Alpine v3.12 | freeradius | 3.0.19-r3 | — |
| Alpine v3.11 | freeradius | 3.0.19-r3 | — |
| Alpine v3.10 | freeradius | 3.0.19-r3 | — |
| Alpine v3.9 | freeradius | 3.0.17-r6 | — |
| Alpine v3.8 | freeradius | 3.0.17-r4 | — |
| Alpine v3.7 | freeradius | 3.0.17-r5 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | freeradius +11 | 3.0.13-15.amzn2 | ALAS2-2020-1515 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | freeradius +11 | 3.0.17-6.module+el8.1.0+5424+14f3dc7c | ELSA-2019-3353 |
| Oracle Linux 7 | freeradius +11 | 3.0.13-15.el7 | ELSA-2020-3984 |
Advisories 5
- RHSA-2020:3984 Red Hat Security Advisory: freeradius security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2019:3353 Red Hat Security Advisory: freeradius:3.0 security and bug fix update Red Hat Security Advisories (RHSA) · Feb 21, 2026
- ALAS2-2020-1515 Moderate: freeradius security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 22, 2020
- ELSA-2020-3984 Moderate: freeradius security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 6, 2020
- ELSA-2019-3353 Moderate: freeradius:3.0 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019
References
- FEDORA-2019-4a8eeaf80e vendor-advisory
- FEDORA-2019-9454ce61b2 vendor-advisory
- RHSA-2019:3353 vendor-advisory
- 20191115 [AIT-SA-20191112-01] CVE-2019-10143: Privilege Escalation via Logrotate in FreeRadius mailing-list
- https://freeradius.org/security/
- http://packetstormsecurity.com/files/155361/FreeRadius-3.0.19-Logrotate-Privilege-Escalation.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10143
- https://github.com/FreeRADIUS/freeradius-server/pull/2666