diff options
| author | zi <zi@FreeBSD.org> | 2017-06-01 21:50:45 +0800 |
|---|---|---|
| committer | zi <zi@FreeBSD.org> | 2017-06-01 21:50:45 +0800 |
| commit | 6ecac977ee183a9ecc588cdb561e36be82c26f80 (patch) | |
| tree | d8c40ee40bafc13e53c47a859c68cb0428a15b9c /security | |
| parent | 6019c39bb090c6bdf4611e23527855ab3330dc04 (diff) | |
| download | freebsd-ports-gnome-6ecac977ee183a9ecc588cdb561e36be82c26f80.tar.gz freebsd-ports-gnome-6ecac977ee183a9ecc588cdb561e36be82c26f80.tar.zst freebsd-ports-gnome-6ecac977ee183a9ecc588cdb561e36be82c26f80.zip | |
- Document vulnerability in net/freeradius3 (CVE-2017-9148)
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 0c22ec969df0..5dabc9c27fb1 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,39 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="673dce46-46d0-11e7-a539-0050569f7e80"> + <topic>FreeRADIUS -- TLS resumption authentication bypass</topic> + <affects> + <package> + <name>freeradius</name> + <name>freeradius2</name> + <name>freeradius3</name> + <range><lt>3.0.14</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Stefan Winter reports:</p> + <blockquote cite="http://seclists.org/oss-sec/2017/q2/342"> + <p>The TLS session cache in FreeRADIUS before 3.0.14 fails to + reliably prevent resumption of an unauthenticated session, which + allows remote attackers (such as malicious 802.1X supplicants) to + bypass authentication via PEAP or TTLS.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2017-9148</cvename> + <url>http://freeradius.org/security.html</url> + <url>http://seclists.org/oss-sec/2017/q2/342</url> + <url>http://www.securityfocus.com/bid/98734</url> + </references> + <dates> + <discovery>2017-02-03</discovery> + <entry>2017-06-01</entry> + </dates> + </vuln> + <vuln vid="40a8d798-4615-11e7-8080-a4badb2f4699"> <topic>heimdal -- bypass of capath policy</topic> <affects> |