SUSE-SU-2022:4622-1

UNKNOWN

Security update for freeradius-server

Published Dec 27, 2022

Modified 3 years ago

Fix available

Details

This update for freeradius-server fixes the following issues:

CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).
CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).
CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).

Affected Packages(12 packages)

freeradius-server

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-devel

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-krb5

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-ldap

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-libs

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-mysql

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-perl

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-postgresql

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-python3

Fixed in:

3.0.21-150200.3.12.1

freeradius-server-sqlite

Fixed in:

3.0.21-150200.3.12.1

References

REPORT

https://bugzilla.suse.com/1206204

REPORT

https://bugzilla.suse.com/1206205

REPORT

https://bugzilla.suse.com/1206206

WEB

https://www.suse.com/security/cve/CVE-2022-41859

WEB

https://www.suse.com/security/cve/CVE-2022-41860

WEB

https://www.suse.com/security/cve/CVE-2022-41861

ADVISORY

https://www.suse.com/support/update/announcement/2022/suse-su-20224622-1/

Upstream

CVE-2022-41859 CVE-2022-41860 CVE-2022-41861

Ecosystems(17)

SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Timeline

PublishedDec 27, 2022

ModifiedDec 27, 2022

SUSE-SU-2022:4622-1 | Mondoo Vulnerability Intelligence