Security update for freeradius-server SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1181-1 Final 1 1 2019-05-07T16:10:05Z current 2019-05-07T16:10:05Z 2019-05-07T16:10:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for freeradius-server This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549). - CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-1181,SUSE-SLE-SDK-12-SP3-2019-1181,SUSE-SLE-SDK-12-SP4-2019-1181,SUSE-SLE-SERVER-12-SP3-2019-1181,SUSE-SLE-SERVER-12-SP4-2019-1181 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191181-1/ Link for SUSE-SU-2019:1181-1 https://lists.suse.com/pipermail/sle-security-updates/2019-May/005429.html E-Mail link for SUSE-SU-2019:1181-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1132549 SUSE Bug 1132549 https://bugzilla.suse.com/1132664 SUSE Bug 1132664 https://www.suse.com/security/cve/CVE-2019-11234/ SUSE CVE CVE-2019-11234 page https://www.suse.com/security/cve/CVE-2019-11235/ SUSE CVE CVE-2019-11235 page SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 freeradius-server-3.0.15-2.11.2 freeradius-server-devel-3.0.15-2.11.2 freeradius-server-doc-3.0.15-2.11.2 freeradius-server-krb5-3.0.15-2.11.2 freeradius-server-ldap-3.0.15-2.11.2 freeradius-server-libs-3.0.15-2.11.2 freeradius-server-mysql-3.0.15-2.11.2 freeradius-server-perl-3.0.15-2.11.2 freeradius-server-postgresql-3.0.15-2.11.2 freeradius-server-python-3.0.15-2.11.2 freeradius-server-sqlite-3.0.15-2.11.2 freeradius-server-utils-3.0.15-2.11.2 freeradius-server-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-doc-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-krb5-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-ldap-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-libs-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-mysql-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-perl-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-postgresql-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-python-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-sqlite-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-utils-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-doc-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-krb5-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-ldap-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-libs-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-mysql-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-perl-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-postgresql-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-python-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-sqlite-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-utils-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-doc-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-krb5-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-ldap-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-libs-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-mysql-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-perl-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-postgresql-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-python-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-sqlite-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-utils-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 freeradius-server-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-doc-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-krb5-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-ldap-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-libs-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-mysql-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-perl-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-postgresql-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-python-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-sqlite-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-utils-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-devel-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 freeradius-server-devel-3.0.15-2.11.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. CVE-2019-11234 SUSE Linux Enterprise Server 12 SP3:freeradius-server-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-doc-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-krb5-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-ldap-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-libs-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-mysql-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-perl-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-postgresql-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-python-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-sqlite-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-utils-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-doc-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-krb5-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-ldap-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-libs-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-mysql-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-perl-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-postgresql-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-python-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-sqlite-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-utils-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-doc-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-krb5-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-ldap-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-libs-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-mysql-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-perl-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-postgresql-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-python-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-sqlite-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-utils-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-doc-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-krb5-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-ldap-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-libs-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-mysql-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-perl-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-postgresql-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-python-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-sqlite-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-utils-3.0.15-2.11.2 SUSE Linux Enterprise Software Development Kit 12 SP3:freeradius-server-devel-3.0.15-2.11.2 SUSE Linux Enterprise Software Development Kit 12 SP4:freeradius-server-devel-3.0.15-2.11.2 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 6.8 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191181-1/ https://www.suse.com/security/cve/CVE-2019-11234.html CVE-2019-11234 https://bugzilla.suse.com/1132664 SUSE Bug 1132664 FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499. CVE-2019-11235 SUSE Linux Enterprise Server 12 SP3:freeradius-server-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-doc-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-krb5-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-ldap-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-libs-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-mysql-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-perl-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-postgresql-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-python-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-sqlite-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP3:freeradius-server-utils-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-doc-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-krb5-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-ldap-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-libs-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-mysql-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-perl-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-postgresql-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-python-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-sqlite-3.0.15-2.11.2 SUSE Linux Enterprise Server 12 SP4:freeradius-server-utils-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-doc-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-krb5-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-ldap-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-libs-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-mysql-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-perl-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-postgresql-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-python-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-sqlite-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:freeradius-server-utils-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-doc-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-krb5-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-ldap-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-libs-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-mysql-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-perl-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-postgresql-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-python-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-sqlite-3.0.15-2.11.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-utils-3.0.15-2.11.2 SUSE Linux Enterprise Software Development Kit 12 SP3:freeradius-server-devel-3.0.15-2.11.2 SUSE Linux Enterprise Software Development Kit 12 SP4:freeradius-server-devel-3.0.15-2.11.2 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 8.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191181-1/ https://www.suse.com/security/cve/CVE-2019-11235.html CVE-2019-11235 https://bugzilla.suse.com/1132549 SUSE Bug 1132549 https://bugzilla.suse.com/1132664 SUSE Bug 1132664 https://bugzilla.suse.com/1144524 SUSE Bug 1144524