Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:1018-1

Опубликовано: 17 апр. 2020
Источник: suse-cvrf

Описание

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

  • CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd (bsc#1144524).
  • CVE-2019-17185: Fixed a debial of service due to multithreaded BN_CTX access (bsc#1166847).
  • Fixed an issue in TLS-EAP where the OCSP verification, when an intermediate client certificate was not explicitly trusted (bsc#1146848).

Список пакетов

HPE Helion OpenStack 8
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1
SUSE Enterprise Storage 5
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1
SUSE Linux Enterprise Server 12 SP3-BCL
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1
SUSE Linux Enterprise Server 12 SP3-LTSS
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1
SUSE Linux Enterprise Server 12 SP4
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1
SUSE Linux Enterprise Software Development Kit 12 SP4
freeradius-server-devel-3.0.15-2.14.1
SUSE OpenStack Cloud 8
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1
SUSE OpenStack Cloud Crowbar 8
freeradius-server-3.0.15-2.14.1
freeradius-server-doc-3.0.15-2.14.1
freeradius-server-krb5-3.0.15-2.14.1
freeradius-server-ldap-3.0.15-2.14.1
freeradius-server-libs-3.0.15-2.14.1
freeradius-server-mysql-3.0.15-2.14.1
freeradius-server-perl-3.0.15-2.14.1
freeradius-server-postgresql-3.0.15-2.14.1
freeradius-server-python-3.0.15-2.14.1
freeradius-server-sqlite-3.0.15-2.14.1
freeradius-server-utils-3.0.15-2.14.1

Ссылки

Описание

In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.

Затронутые продукты
HPE Helion OpenStack 8:freeradius-server-3.0.15-2.14.1
HPE Helion OpenStack 8:freeradius-server-doc-3.0.15-2.14.1
HPE Helion OpenStack 8:freeradius-server-krb5-3.0.15-2.14.1
HPE Helion OpenStack 8:freeradius-server-ldap-3.0.15-2.14.1
Ссылки

Описание

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

Затронутые продукты
HPE Helion OpenStack 8:freeradius-server-3.0.15-2.14.1
HPE Helion OpenStack 8:freeradius-server-doc-3.0.15-2.14.1
HPE Helion OpenStack 8:freeradius-server-krb5-3.0.15-2.14.1
HPE Helion OpenStack 8:freeradius-server-ldap-3.0.15-2.14.1
Ссылки
Уязвимость SUSE-SU-2020:1018-1