Security update for freeradius-server
SUSE Security Update: Security update for freeradius-server
| Announcement ID: | SUSE-SU-2017:1777-1 |
| Rating: | moderate |
| References: | #1041445 #912873 #935573 |
| Affected Products: |
An update that solves two vulnerabilities and has one errata is now available.
Description:
This update for freeradius-server fixes the following issues:
- CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate
authentication bypass. (bnc#1041445)
- CVE-2015-4680: Add a configuration option to allow checking of all
intermediate certificates for revocations. (bnc#935573)
The following non security issue was fixed:
- Cannot create table radpostauth because of deprecated TIMESTAMP(14)
syntax. (bsc#912873)
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11-SP4:
zypper in -t patch sdksp4-freeradius-server-13192=1 - SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-freeradius-server-13192=1 - SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-freeradius-server-13192=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- freeradius-server-devel-2.1.1-7.24.1
- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64):
- freeradius-server-libs-2.1.1-7.24.1
- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- freeradius-server-2.1.1-7.24.1
- freeradius-server-dialupadmin-2.1.1-7.24.1
- freeradius-server-doc-2.1.1-7.24.1
- freeradius-server-libs-2.1.1-7.24.1
- freeradius-server-utils-2.1.1-7.24.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- freeradius-server-debuginfo-2.1.1-7.24.1
- freeradius-server-debugsource-2.1.1-7.24.1