Security update for freeradius-server SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:0542-1 Final 1 1 2020-04-23T08:10:23Z current 2020-04-23T08:10:23Z 2020-04-23T08:10:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for freeradius-server This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549). - CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-542 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2020-04/msg00105.html E-Mail link for openSUSE-SU-2020:0542-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1132549 SUSE Bug 1132549 https://bugzilla.suse.com/1132664 SUSE Bug 1132664 https://www.suse.com/security/cve/CVE-2019-11234/ SUSE CVE CVE-2019-11234 page https://www.suse.com/security/cve/CVE-2019-11235/ SUSE CVE CVE-2019-11235 page openSUSE Leap 15.1 freeradius-server-3.0.16-lp151.4.3.1 freeradius-server-devel-3.0.16-lp151.4.3.1 freeradius-server-doc-3.0.16-lp151.4.3.1 freeradius-server-krb5-3.0.16-lp151.4.3.1 freeradius-server-ldap-3.0.16-lp151.4.3.1 freeradius-server-libs-3.0.16-lp151.4.3.1 freeradius-server-mysql-3.0.16-lp151.4.3.1 freeradius-server-perl-3.0.16-lp151.4.3.1 freeradius-server-postgresql-3.0.16-lp151.4.3.1 freeradius-server-python-3.0.16-lp151.4.3.1 freeradius-server-sqlite-3.0.16-lp151.4.3.1 freeradius-server-utils-3.0.16-lp151.4.3.1 freeradius-server-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-devel-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-doc-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-krb5-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-ldap-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-libs-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-mysql-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-perl-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-postgresql-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-python-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-sqlite-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 freeradius-server-utils-3.0.16-lp151.4.3.1 as a component of openSUSE Leap 15.1 FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. CVE-2019-11234 openSUSE Leap 15.1:freeradius-server-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-devel-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-doc-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-krb5-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-ldap-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-libs-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-mysql-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-perl-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-postgresql-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-python-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-sqlite-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-utils-3.0.16-lp151.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-updates/2020-04/msg00105.html https://www.suse.com/security/cve/CVE-2019-11234.html CVE-2019-11234 https://bugzilla.suse.com/1132664 SUSE Bug 1132664 FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499. CVE-2019-11235 openSUSE Leap 15.1:freeradius-server-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-devel-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-doc-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-krb5-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-ldap-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-libs-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-mysql-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-perl-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-postgresql-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-python-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-sqlite-3.0.16-lp151.4.3.1 openSUSE Leap 15.1:freeradius-server-utils-3.0.16-lp151.4.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-updates/2020-04/msg00105.html https://www.suse.com/security/cve/CVE-2019-11235.html CVE-2019-11235 https://bugzilla.suse.com/1132549 SUSE Bug 1132549 https://bugzilla.suse.com/1132664 SUSE Bug 1132664 https://bugzilla.suse.com/1144524 SUSE Bug 1144524