Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:4621-1

Опубликовано: 27 дек. 2022
Источник: suse-cvrf

Описание

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

  • CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).
  • CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).
  • CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).

Список пакетов

SUSE Linux Enterprise Server 12 SP5
freeradius-server-3.0.19-3.12.1
freeradius-server-doc-3.0.19-3.12.1
freeradius-server-krb5-3.0.19-3.12.1
freeradius-server-ldap-3.0.19-3.12.1
freeradius-server-libs-3.0.19-3.12.1
freeradius-server-mysql-3.0.19-3.12.1
freeradius-server-perl-3.0.19-3.12.1
freeradius-server-postgresql-3.0.19-3.12.1
freeradius-server-python-3.0.19-3.12.1
freeradius-server-sqlite-3.0.19-3.12.1
freeradius-server-utils-3.0.19-3.12.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
freeradius-server-3.0.19-3.12.1
freeradius-server-doc-3.0.19-3.12.1
freeradius-server-krb5-3.0.19-3.12.1
freeradius-server-ldap-3.0.19-3.12.1
freeradius-server-libs-3.0.19-3.12.1
freeradius-server-mysql-3.0.19-3.12.1
freeradius-server-perl-3.0.19-3.12.1
freeradius-server-postgresql-3.0.19-3.12.1
freeradius-server-python-3.0.19-3.12.1
freeradius-server-sqlite-3.0.19-3.12.1
freeradius-server-utils-3.0.19-3.12.1
SUSE Linux Enterprise Software Development Kit 12 SP5
freeradius-server-devel-3.0.19-3.12.1

Ссылки

Описание

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5:freeradius-server-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-doc-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-krb5-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-ldap-3.0.19-3.12.1
Ссылки

Описание

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5:freeradius-server-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-doc-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-krb5-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-ldap-3.0.19-3.12.1
Ссылки

Описание

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5:freeradius-server-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-doc-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-krb5-3.0.19-3.12.1
SUSE Linux Enterprise Server 12 SP5:freeradius-server-ldap-3.0.19-3.12.1
Ссылки
Уязвимость SUSE-SU-2022:4621-1