Issued:
2020-09-29
Updated:
2020-09-29

RHSA-2020:3984 - Security Advisory

Synopsis

Moderate: freeradius security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for freeradius is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

  • freeradius: privilege escalation due to insecure logrotate configuration (CVE-2019-10143)
  • freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations (CVE-2019-13456)
  • freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access (CVE-2019-17185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, radiusd must be restarted for the changes to take effect.

Affected Products

  • Red Hat Enterprise Linux Server 7 x86_64
  • Red Hat Enterprise Linux Workstation 7 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 7 s390x
  • Red Hat Enterprise Linux for Power, big endian 7 ppc64
  • Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

  • BZ - 1592741 - Freeradius paircompare with attribute references and expansions
  • BZ - 1630684 - correct receiving of multiple RADIUS packets through RadSec by freeradius
  • BZ - 1677435 - freeradius logs cleartext PAP passwords on failure
  • BZ - 1705340 - CVE-2019-10143 freeradius: privilege escalation due to insecure logrotate configuration
  • BZ - 1737663 - CVE-2019-13456 freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations
  • BZ - 1816680 - CVE-2019-17185 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access

Red Hat Enterprise Linux Server 7

SRPM
freeradius-3.0.13-15.el7.src.rpm SHA-256: 33fa67f5ebcb6e4e1b7b9746d6418b9d48fcc8ebba0ab1ebda240c79487c81d3
x86_64
freeradius-3.0.13-15.el7.x86_64.rpm SHA-256: 8d34904e2ae43c352c8750286dcea563a1a59c38f33f79cae4e2dbe1d74d637b
freeradius-debuginfo-3.0.13-15.el7.i686.rpm SHA-256: c8abe606dcae5af27ec52b10bd8137069f8c8627d5e23507f10d430c022f3ef6
freeradius-debuginfo-3.0.13-15.el7.x86_64.rpm SHA-256: 984ec7675481a94fb10b164f68781c1f8eb2ef4182e9f2797126771468dfe587
freeradius-debuginfo-3.0.13-15.el7.x86_64.rpm SHA-256: 984ec7675481a94fb10b164f68781c1f8eb2ef4182e9f2797126771468dfe587
freeradius-devel-3.0.13-15.el7.i686.rpm SHA-256: 337ccf48f6d26992f52dd4a1be74e0930fccedf2f3f2301b7e4fe97dfe69276c
freeradius-devel-3.0.13-15.el7.x86_64.rpm SHA-256: cca5538679e785610c42f652b56b20570eb7860a6dc49c27321500d50eec9502
freeradius-doc-3.0.13-15.el7.x86_64.rpm SHA-256: 27b2229658c7066fd981ea1e37cdfd72fa8118c454d16fe91c6caaeb4d833038
freeradius-krb5-3.0.13-15.el7.x86_64.rpm SHA-256: 67d7ebc038743c5d8cc980918133a70f0a211b2fe65e75f45b3649f43fbec80f
freeradius-ldap-3.0.13-15.el7.x86_64.rpm SHA-256: 29536917224f2ce886865d7d5fe17fc7785cea8a9bacc20bad113c3411831f04
freeradius-mysql-3.0.13-15.el7.x86_64.rpm SHA-256: 126e8b9968c88527392cbb85af83531c391385a2c9a7beef8f4f1f93fa889a33
freeradius-perl-3.0.13-15.el7.x86_64.rpm SHA-256: 3db5b28ce4c7e8db34bcf6acbec89e7285107f68cf1bfdff9d71df095a2bf89e
freeradius-postgresql-3.0.13-15.el7.x86_64.rpm SHA-256: 39d1b44a5d5670179b57e6b34d0cff82c40675f2495cb713bda347dc12c662ba
freeradius-python-3.0.13-15.el7.x86_64.rpm SHA-256: 7f066ad32c05f80f4b69fd2db09f1217cb88afb28d62dd4376d8e5ed88bf1d20
freeradius-sqlite-3.0.13-15.el7.x86_64.rpm SHA-256: 3ff407c87fccf52d930696ec63094ce9829444fddf9735a3de55c8582d37da7c
freeradius-unixODBC-3.0.13-15.el7.x86_64.rpm SHA-256: 45d15e6c1171c59056d1209e04621f1ec8edef9ad822eea68d729b91e038fb9e
freeradius-utils-3.0.13-15.el7.x86_64.rpm SHA-256: 92d2576f9b77deab93ba48e4753459c1e81a582762926f7b4095356b4481a1d5

Red Hat Enterprise Linux Workstation 7

SRPM
freeradius-3.0.13-15.el7.src.rpm SHA-256: 33fa67f5ebcb6e4e1b7b9746d6418b9d48fcc8ebba0ab1ebda240c79487c81d3
x86_64
freeradius-3.0.13-15.el7.x86_64.rpm SHA-256: 8d34904e2ae43c352c8750286dcea563a1a59c38f33f79cae4e2dbe1d74d637b
freeradius-debuginfo-3.0.13-15.el7.i686.rpm SHA-256: c8abe606dcae5af27ec52b10bd8137069f8c8627d5e23507f10d430c022f3ef6
freeradius-debuginfo-3.0.13-15.el7.x86_64.rpm SHA-256: 984ec7675481a94fb10b164f68781c1f8eb2ef4182e9f2797126771468dfe587
freeradius-debuginfo-3.0.13-15.el7.x86_64.rpm SHA-256: 984ec7675481a94fb10b164f68781c1f8eb2ef4182e9f2797126771468dfe587
freeradius-devel-3.0.13-15.el7.i686.rpm SHA-256: 337ccf48f6d26992f52dd4a1be74e0930fccedf2f3f2301b7e4fe97dfe69276c
freeradius-devel-3.0.13-15.el7.x86_64.rpm SHA-256: cca5538679e785610c42f652b56b20570eb7860a6dc49c27321500d50eec9502
freeradius-doc-3.0.13-15.el7.x86_64.rpm SHA-256: 27b2229658c7066fd981ea1e37cdfd72fa8118c454d16fe91c6caaeb4d833038
freeradius-krb5-3.0.13-15.el7.x86_64.rpm SHA-256: 67d7ebc038743c5d8cc980918133a70f0a211b2fe65e75f45b3649f43fbec80f
freeradius-ldap-3.0.13-15.el7.x86_64.rpm SHA-256: 29536917224f2ce886865d7d5fe17fc7785cea8a9bacc20bad113c3411831f04
freeradius-mysql-3.0.13-15.el7.x86_64.rpm SHA-256: 126e8b9968c88527392cbb85af83531c391385a2c9a7beef8f4f1f93fa889a33
freeradius-perl-3.0.13-15.el7.x86_64.rpm SHA-256: 3db5b28ce4c7e8db34bcf6acbec89e7285107f68cf1bfdff9d71df095a2bf89e
freeradius-postgresql-3.0.13-15.el7.x86_64.rpm SHA-256: 39d1b44a5d5670179b57e6b34d0cff82c40675f2495cb713bda347dc12c662ba
freeradius-python-3.0.13-15.el7.x86_64.rpm SHA-256: 7f066ad32c05f80f4b69fd2db09f1217cb88afb28d62dd4376d8e5ed88bf1d20
freeradius-sqlite-3.0.13-15.el7.x86_64.rpm SHA-256: 3ff407c87fccf52d930696ec63094ce9829444fddf9735a3de55c8582d37da7c
freeradius-unixODBC-3.0.13-15.el7.x86_64.rpm SHA-256: 45d15e6c1171c59056d1209e04621f1ec8edef9ad822eea68d729b91e038fb9e
freeradius-utils-3.0.13-15.el7.x86_64.rpm SHA-256: 92d2576f9b77deab93ba48e4753459c1e81a582762926f7b4095356b4481a1d5

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
freeradius-3.0.13-15.el7.src.rpm SHA-256: 33fa67f5ebcb6e4e1b7b9746d6418b9d48fcc8ebba0ab1ebda240c79487c81d3
s390x
freeradius-3.0.13-15.el7.s390x.rpm SHA-256: a48ecc26e088931f213fa6882e771db48357a4791f04c45773f404f239ab769c
freeradius-debuginfo-3.0.13-15.el7.s390.rpm SHA-256: debfdcac70f8556a3a5182b9328a5561c872c127703622bedb07a69f5a285a0b
freeradius-debuginfo-3.0.13-15.el7.s390x.rpm SHA-256: d103efd7b35916b90af2cd82ea7e72b761c123df72089af8e9650f5d7201b5d9
freeradius-debuginfo-3.0.13-15.el7.s390x.rpm SHA-256: d103efd7b35916b90af2cd82ea7e72b761c123df72089af8e9650f5d7201b5d9
freeradius-devel-3.0.13-15.el7.s390.rpm SHA-256: 4dde12d4533c18dce2b16cc3d3b12a2ca3645064c5ffc2f5975d5e4dce85f01b
freeradius-devel-3.0.13-15.el7.s390x.rpm SHA-256: d85c2783a70485ba48795e9dde6f173642ac7245f2e234c8f12bafeb700ad8bc
freeradius-doc-3.0.13-15.el7.s390x.rpm SHA-256: ff1022316a3c3d71188b2323f90f07d2b64f37c2740c3103576fb3048d239f7a
freeradius-krb5-3.0.13-15.el7.s390x.rpm SHA-256: e93ec366aeccb13f8c7d50edc4e0e096b1fe005d1ffb6a0ce5cd8103c4d800b5
freeradius-ldap-3.0.13-15.el7.s390x.rpm SHA-256: 7c6b54443bd4c6677f4e255ba980b91c022ec917331fa03dec1dc2ea2102ed8a
freeradius-mysql-3.0.13-15.el7.s390x.rpm SHA-256: 4ea0eb5e788723ed1e535b53be514f051416fbd0335bb413cf01a44533631f3a
freeradius-perl-3.0.13-15.el7.s390x.rpm SHA-256: a1ffd95644a862650d555f11b898d0136c64f9aaef60f24859cafe944a6f4365
freeradius-postgresql-3.0.13-15.el7.s390x.rpm SHA-256: ba64943e5306a37fbd54730183ba0e7413e99b8214833dd396cc8cc1dbab378e
freeradius-python-3.0.13-15.el7.s390x.rpm SHA-256: 86d5541a034a9228e5c4272c7208664f583a6912d80bba6357e47cd544dbe3e1
freeradius-sqlite-3.0.13-15.el7.s390x.rpm SHA-256: b1e5391ca505a9f76a38c469ab19dcdd452f537ba986df39937376048a40f5c9
freeradius-unixODBC-3.0.13-15.el7.s390x.rpm SHA-256: 2a210d937b0aa94aedb5ca588b6b25685ad48bea400d4aeb3f9b08174278d760
freeradius-utils-3.0.13-15.el7.s390x.rpm SHA-256: 510600fe061a89a29891f9e1135b3cab8a6f4259d53d88ec1b3a8698e7e58e96

Red Hat Enterprise Linux for Power, big endian 7

SRPM
freeradius-3.0.13-15.el7.src.rpm SHA-256: 33fa67f5ebcb6e4e1b7b9746d6418b9d48fcc8ebba0ab1ebda240c79487c81d3
ppc64
freeradius-3.0.13-15.el7.ppc64.rpm SHA-256: ac01950359f0f69065e8558291470dd60e5aa90de5ff8912084424715f8e0bd1
freeradius-debuginfo-3.0.13-15.el7.ppc.rpm SHA-256: f12067dd6f363d1a29a396bc3288800b06c8cd0eab75ce322c860e0f32375849
freeradius-debuginfo-3.0.13-15.el7.ppc64.rpm SHA-256: aafbc60f18758833bd119a58e6737652ed31559fe1d09b7a0a8f37b693965ae3
freeradius-debuginfo-3.0.13-15.el7.ppc64.rpm SHA-256: aafbc60f18758833bd119a58e6737652ed31559fe1d09b7a0a8f37b693965ae3
freeradius-devel-3.0.13-15.el7.ppc.rpm SHA-256: 3c656bf56ecfc57c492aa8921242aa0a814458f698e25a01d562840d923354bb
freeradius-devel-3.0.13-15.el7.ppc64.rpm SHA-256: 5abba638f2b7aeb1fad2f7fe19de279ab0ebda7e00adbf125c7f9791c2db51a8
freeradius-doc-3.0.13-15.el7.ppc64.rpm SHA-256: e73bb0c08b62ce9c417ed5471fccc777b56b4cc4f6d6d999d5ece2e5f349c852
freeradius-krb5-3.0.13-15.el7.ppc64.rpm SHA-256: 1f2624b5a4fe5643a716595aa0edd1f246f8e1990d67fb2bfb9b7b2a355c54d8
freeradius-ldap-3.0.13-15.el7.ppc64.rpm SHA-256: 486c4b54d03863b8c44dcb35629361d8cc2df42516b4c872df639c5feee9b20e
freeradius-mysql-3.0.13-15.el7.ppc64.rpm SHA-256: d74005aa9e5f30221247c276d3809a1ffdca1698e20534f649087da600b7d173
freeradius-perl-3.0.13-15.el7.ppc64.rpm SHA-256: 995ed240993bb560d56ed95564867927cff05b8facb897a32601d42835aa48d5
freeradius-postgresql-3.0.13-15.el7.ppc64.rpm SHA-256: cb40905bbccc152d2f0740fddf2411ce7b12368baa1f6e55e9983b83c47aba77
freeradius-python-3.0.13-15.el7.ppc64.rpm SHA-256: e05379a88675a2e8b0331065e7fc5be52389cfaa5d731b617c2fd22035dc92c9
freeradius-sqlite-3.0.13-15.el7.ppc64.rpm SHA-256: f96967e2d8e5b8c20e141d80408b59cd06e8e41344221a9cc52e51f206e3f30a
freeradius-unixODBC-3.0.13-15.el7.ppc64.rpm SHA-256: 1349129049736e527e13c166e19766b3851a0606b0da87361367e4f4d4e38f45
freeradius-utils-3.0.13-15.el7.ppc64.rpm SHA-256: 09357b29e1f71b0153701d4fef5935792d820ac91f3f517cac5e00295062ae15

Red Hat Enterprise Linux for Power, little endian 7

SRPM
freeradius-3.0.13-15.el7.src.rpm SHA-256: 33fa67f5ebcb6e4e1b7b9746d6418b9d48fcc8ebba0ab1ebda240c79487c81d3
ppc64le
freeradius-3.0.13-15.el7.ppc64le.rpm SHA-256: 493888a60d0d24248e47923208407c029492d07361d2cbc4d6aec9c66df1f5be
freeradius-debuginfo-3.0.13-15.el7.ppc64le.rpm SHA-256: 43edec32bd1cde5eebb8df8c0c4f5e47e792fb73fcfd25e93d569cd4adebec92
freeradius-debuginfo-3.0.13-15.el7.ppc64le.rpm SHA-256: 43edec32bd1cde5eebb8df8c0c4f5e47e792fb73fcfd25e93d569cd4adebec92
freeradius-devel-3.0.13-15.el7.ppc64le.rpm SHA-256: 740d11d5ad14a3725802a67809862b3cc6ae371f78b61ab9912184b571b2f824
freeradius-doc-3.0.13-15.el7.ppc64le.rpm SHA-256: 3dc39cb417b7caf852cf279c165edf6561a2e0f99deb3a89e2b4be7698e350a5
freeradius-krb5-3.0.13-15.el7.ppc64le.rpm SHA-256: 84b9ea074bfc47520fd5fd3d01d8337b5370ba0f17b26112def021830d0a6af7
freeradius-ldap-3.0.13-15.el7.ppc64le.rpm SHA-256: 6612448f6c461f55849940cad3163cd4e8f1a3a67071e1170794ed21460f35e9
freeradius-mysql-3.0.13-15.el7.ppc64le.rpm SHA-256: fe5e473e86c2fa92cf4e8eddd9203179a7fdce3bb7a64cecc90d88fdbcd5a730
freeradius-perl-3.0.13-15.el7.ppc64le.rpm SHA-256: 5d89a3b02c3c780bbc591f8d06017d8de23e82fc96e5d264dd40fc04c583e4e6
freeradius-postgresql-3.0.13-15.el7.ppc64le.rpm SHA-256: ad2695641db59074fdd474a0ebbbcb232e5fa9a9d2d3a73523b0eb398f078174
freeradius-python-3.0.13-15.el7.ppc64le.rpm SHA-256: fc5e8080ee5ab66d95e90776d47f093fea1d478beeaa61edd9fd09ab51cba3f3
freeradius-sqlite-3.0.13-15.el7.ppc64le.rpm SHA-256: 921816ebb583712b4d8344a42f1332dc6847732d681b09f2e203b5af253c1200
freeradius-unixODBC-3.0.13-15.el7.ppc64le.rpm SHA-256: 8a4e3d486c7c553e6cb0f004d766afcd394748d276cbc63d61717359938cba68
freeradius-utils-3.0.13-15.el7.ppc64le.rpm SHA-256: 7f727a8497b5a1786efbfa41608d5c1f6a04dd8845fa0ca97185a9bed7265b4d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.