From ${URL} : #2015-008 FreeRADIUS insufficent CRL application Description: The FreeRADIUS server is an open source project that provides a RADIUS implementation. The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates. An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS. Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the complete trust chain. The FreeRADIUS project advises that the recommended configuration is to use self-signed CAs for all EAP-TLS methods. Affected version: FreeRADIUS <= 2.2.7, <= 3.0.8 Fixed version: FreeRADIUS >= 2.2.8, >= 3.0.9 Credit: vulnerability anonymously reported. CVE: CVE-2015-4680 Timeline: 2015-06-17: vulnerability report received 2015-06-18: contacted FreeRADIUS security maintainer 2015-06-18: patch provided by maintainer 2015-06-19: assigned CVE 2015-06-22: advisory release References: https://github.com/FreeRADIUS/freeradius-server/blob/b28326004379260ca2fe7b8884f813d90a741197/src/main/tls.c#L2111 https://github.com/FreeRADIUS/freeradius-server/blob/b28326004379260ca2fe7b8884f813d90a741197/src/main/tls.c#L2595 http://freeradius.org/security.html Permalink: http://www.ocert.org/advisories/ocert-2015-008.html @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
It has been some time since this Bug received an update. Since it is security related, bringing it up to the surface so it is not forgotten. Any updates?
commit 3a7259637a572d5818ad1c363fe4a85282823e12 Author: Lars Wendler <polynomial-c@gentoo.org> Date: Wed Apr 20 10:03:56 2016 net-dialup/freeradius: Security bump to versions 2.2.9 and 3.0.11 See security bugs #553308 and #560994. Also fixing version bump request #551246, init script bug #551246 and missing dependency on sys-libs/talloc (#543302). Package-Manager: portage-2.2.28 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> I am not using freeradius myself but I suggest we start stabilization of =net-dialup/freeradius-2.2.9 in order to get rid of the two known security bugs.
Arches, please test and mark stable: =net-dialup/freeradius-2.2.9 Target Keywords : "amd64 x86" Thank you!
amd64 stable
Ping a reminder for x86 stabilization
x86 stable. Maintainer(s), please cleanup. Security, please vote.
Devaway... https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8e0574b15e5d814f53f7abd2c11c1297b7973283 GLSA Vote: No
