0

In July 2017, multiple security issues have been found in FreeRadius 2.x.x and 3.0.x. RHEL 6 uses FreeRadius 2.x.x and Red Hat has released security advisory RHSA-2017:1759. However, for RHEL 7, no security advisory exists, as far as I can see.

However, the latest version on RHEL at the time of writing this is freeradius-3.0.4-8.el7_3, and the issues are fixed in FreeRadius 3.0.15. I know that Red Hat can backport certain fixes from newer versions in its packages, but is this what happened?

How can I find out if I'm secure against these issues?

Improve this question

1 Answer 1

Reset to default
0

If you dig into the CVE detail listed for the first CVE on that RHSA, it appears that RHEL 7 is affected but not yet addressed. Since it is listed as "affected" and not "will not fix", Red Hat will likely release a new RHSA or update the existing one as soon as they have the fix backported for RHEL 7.

Red Hat Errata for CVE-2017-10978

Note that there is an RHSA titled "Red Hat Enterprise Linux 7 (freeradius)", but it is older (RHSA 1581 vs. 1759 for the new RHEL 6 RHSA) and addresses a different CVE. It is, in fact, the one that produced the freeradius-3.0.4-8.el7_3 that you're looking at.

Improve this answer
1
  • I had noticed the other CVE too, but it's not related to this CVE, as you said. I'll punch the actual CVE into the Red Hat site next time, today I learned. I had expected Red Hat to release an RHSA immediately, even if no patch is available, but that's apparently not how it works.
    – jornane
    Commented Jul 19, 2017 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .