In July 2017, multiple security issues have been found in FreeRadius 2.x.x and 3.0.x. RHEL 6 uses FreeRadius 2.x.x and Red Hat has released security advisory RHSA-2017:1759. However, for RHEL 7, no security advisory exists, as far as I can see.

However, the latest version on RHEL at the time of writing this is freeradius-3.0.4-8.el7_3, and the issues are fixed in FreeRadius 3.0.15. I know that Red Hat can backport certain fixes from newer versions in its packages, but is this what happened?

How can I find out if I'm secure against these issues?


If you dig into the CVE detail listed for the first CVE on that RHSA, it appears that RHEL 7 is affected but not yet addressed. Since it is listed as "affected" and not "will not fix", Red Hat will likely release a new RHSA or update the existing one as soon as they have the fix backported for RHEL 7.

Red Hat Errata for CVE-2017-10978

Note that there is an RHSA titled "Red Hat Enterprise Linux 7 (freeradius)", but it is older (RHSA 1581 vs. 1759 for the new RHEL 6 RHSA) and addresses a different CVE. It is, in fact, the one that produced the freeradius-3.0.4-8.el7_3 that you're looking at.

  • I had noticed the other CVE too, but it's not related to this CVE, as you said. I'll punch the actual CVE into the Red Hat site next time, today I learned. I had expected Red Hat to release an RHSA immediately, even if no patch is available, but that's apparently not how it works. – jornane Jul 19 '17 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.