CVE-2015-4680 FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
HighCVSS 7.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/freeradius(Debian:12) | < 2.2.8+dfsg-0.1 | 2.2.8+dfsg-0.1 |
| debian/freeradius(Debian:13) | < 2.2.8+dfsg-0.1 | 2.2.8+dfsg-0.1 |
| debian/freeradius(Debian:14) | < 2.2.8+dfsg-0.1 | 2.2.8+dfsg-0.1 |
| freeradius | = 3.0.0 | No fix listed |
| freeradius | = 3.0.1 | No fix listed |
| freeradius | = 3.0.2 | No fix listed |
| freeradius | = 3.0.3 | No fix listed |
| freeradius | = 3.0.4 | No fix listed |
| freeradius | = 3.0.5 | No fix listed |
| freeradius | = 3.0.6 | No fix listed |
| freeradius | = 3.0.7 | No fix listed |
| freeradius | = 3.0.8 | No fix listed |
| freeradius | = 2.2.0 | No fix listed |
| freeradius | = 2.2.1 | No fix listed |
| freeradius | = 2.2.2 | No fix listed |
| freeradius | = 2.2.3 | No fix listed |
| freeradius | = 2.2.4 | No fix listed |
| freeradius | = 2.2.5 | No fix listed |
| freeradius | = 2.2.6 | No fix listed |
| freeradius | = 2.2.7 | No fix listed |
| SUSE linux enterprise server | = 12-sp1 | No fix listed |
| SUSE linux enterprise server | = 12-sp2 | No fix listed |
| SUSE linux enterprise software development kit | = 12-sp1 | No fix listed |
| SUSE linux enterprise software development kit | = 12-sp2 | No fix listed |
References
- Debian Security Tracker CVE-2015-4680 vendor-advisory
- SUSE-SU-2017:0102 third-party-advisory vendor-advisory
- packetstormsecurity.com patch third-party-advisory vdb-entry
- www.ocert.org patch third-party-advisory
- 20150622 [oCERT-2015-008] FreeRADIUS insufficent CRL application mailing-list
- 75327 third-party-advisory vdb-entry
- 1032690 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch
- bugs.debian.org issue-tracking