Important: freeradius security update
Summary
ALSA-2024:4935: Important: freeradius security update. Affects freeradius versions < 3.0.21-40.el9_4. Fixed in 3.0.21-40.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.
Vulnerability Detail
A forgery attack vulnerability (CVE-2024-3596) has been identified in FreeRADIUS. This vulnerability could potentially lead to unauthorized access and compromise the security of the network.
How To Fix
Minimum fixed version
3.0.21-40.el9_4
This is the first release that contains the fix.
sudo dnf update freeradiusTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the freeradius package to version 3.0.21-40.el9_4 or later to address the forgery attack vulnerability. Failure to do so may result in unauthorized access and compromise of the network's security.
See every vulnerability recorded for freeradius →
FAQ
FreeRADIUS is a free RADIUS server that provides centralized authentication and authorization for a network.
A forgery attack is a type of security vulnerability where an attacker is able to manipulate or forge data to gain unauthorized access or perform malicious actions.
This vulnerability in FreeRADIUS could allow an attacker to perform a forgery attack, potentially leading to unauthorized access and compromising the security of the network.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the moment, there is no known workaround for this vulnerability. It is recommended to update the freeradius package to the latest version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for freeradius.
