Lucene search

K
almalinuxAlmaLinuxALSA-2023:2870
HistoryMay 16, 2023 - 12:00 a.m.

Moderate: freeradius:3.0 security update

2023-05-1600:00:00
errata.almalinux.org
16
freeradius
eap-pwd
eap-sim
security update
information leakage
binary data
cve-2022-41859
cve-2022-41860
cve-2022-41861
almalinux
release notes

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

53.6%

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

  • freeradius: Information leakage in EAP-PWD (CVE-2022-41859)
  • freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)
  • freeradius: Crash on invalid abinary data (CVE-2022-41861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

53.6%