Security update for freeradius-server SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1777-1 Final 1 1 2017-07-04T13:54:26Z current 2017-07-04T13:54:26Z 2017-07-04T13:54:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for freeradius-server This update for freeradius-server fixes the following issues: - CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate authentication bypass. (bnc#1041445) - CVE-2015-4680: Add a configuration option to allow checking of all intermediate certificates for revocations. (bnc#935573) The following non security issue was fixed: - Cannot create table radpostauth because of deprecated TIMESTAMP(14) syntax. (bsc#912873) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-freeradius-server-13192,slessp4-freeradius-server-13192 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171777-1/ Link for SUSE-SU-2017:1777-1 https://lists.suse.com/pipermail/sle-security-updates/2017-July/003008.html E-Mail link for SUSE-SU-2017:1777-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1041445 SUSE Bug 1041445 https://bugzilla.suse.com/912873 SUSE Bug 912873 https://bugzilla.suse.com/935573 SUSE Bug 935573 https://www.suse.com/security/cve/CVE-2015-4680/ SUSE CVE CVE-2015-4680 page https://www.suse.com/security/cve/CVE-2017-9148/ SUSE CVE CVE-2017-9148 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 freeradius-server-devel-2.1.1-7.24.1 freeradius-server-libs-2.1.1-7.24.1 freeradius-server-2.1.1-7.24.1 freeradius-server-dialupadmin-2.1.1-7.24.1 freeradius-server-doc-2.1.1-7.24.1 freeradius-server-utils-2.1.1-7.24.1 freeradius-server-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server 11 SP4 freeradius-server-dialupadmin-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server 11 SP4 freeradius-server-doc-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server 11 SP4 freeradius-server-libs-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server 11 SP4 freeradius-server-utils-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server 11 SP4 freeradius-server-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 freeradius-server-dialupadmin-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 freeradius-server-doc-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 freeradius-server-libs-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 freeradius-server-utils-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 freeradius-server-devel-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 freeradius-server-libs-2.1.1-7.24.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates. CVE-2015-4680 SUSE Linux Enterprise Server 11 SP4:freeradius-server-2.1.1-7.24.1 SUSE Linux Enterprise Server 11 SP4:freeradius-server-dialupadmin-2.1.1-7.24.1 SUSE Linux Enterprise Server 11 SP4:freeradius-server-doc-2.1.1-7.24.1 SUSE Linux Enterprise Server 11 SP4:freeradius-server-libs-2.1.1-7.24.1 SUSE Linux Enterprise Server 11 SP4:freeradius-server-utils-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-dialupadmin-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-doc-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-libs-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-utils-2.1.1-7.24.1 SUSE Linux Enterprise Software Development Kit 11 SP4:freeradius-server-devel-2.1.1-7.24.1 SUSE Linux Enterprise Software Development Kit 11 SP4:freeradius-server-libs-2.1.1-7.24.1 low 4 AV:N/AC:H/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171777-1/ https://www.suse.com/security/cve/CVE-2015-4680.html CVE-2015-4680 https://bugzilla.suse.com/935573 SUSE Bug 935573 The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS. CVE-2017-9148 SUSE Linux Enterprise Server 11 SP4:freeradius-server-2.1.1-7.24.1 SUSE Linux Enterprise Server 11 SP4:freeradius-server-dialupadmin-2.1.1-7.24.1 SUSE Linux Enterprise Server 11 SP4:freeradius-server-doc-2.1.1-7.24.1 SUSE Linux Enterprise Server 11 SP4:freeradius-server-libs-2.1.1-7.24.1 SUSE Linux Enterprise Server 11 SP4:freeradius-server-utils-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-dialupadmin-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-doc-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-libs-2.1.1-7.24.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:freeradius-server-utils-2.1.1-7.24.1 SUSE Linux Enterprise Software Development Kit 11 SP4:freeradius-server-devel-2.1.1-7.24.1 SUSE Linux Enterprise Software Development Kit 11 SP4:freeradius-server-libs-2.1.1-7.24.1 important 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171777-1/ https://www.suse.com/security/cve/CVE-2017-9148.html CVE-2017-9148 https://bugzilla.suse.com/1041445 SUSE Bug 1041445 https://bugzilla.suse.com/1046141 SUSE Bug 1046141