OESA-2023-1022

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1022
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2023-1022.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2023-1022
Upstream
Published
2023-01-06T11:04:47Z
Modified
2025-08-12T05:15:21.271399Z
Summary
freeradius security update
Details

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.

Security Fix(es):

When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

References:

https://freeradius.org/security/

Upstream fix:

https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a(CVE-2022-41860)

A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.

References:

https://freeradius.org/security/

Upstream fix:

https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e(CVE-2022-41861)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:22.03-LTS-SP1 / freeradius

Package

Name
freeradius
Purl
pkg:rpm/openEuler/freeradius&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.25-2.oe2203sp1

Ecosystem specific 

{
    "aarch64": [
        "freeradius-sqlite-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-help-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-devel-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-utils-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-ldap-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-debuginfo-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-mysql-3.0.25-2.oe2203sp1.aarch64.rpm",
        "python3-freeradius-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-debugsource-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-postgresql-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-perl-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-3.0.25-2.oe2203sp1.aarch64.rpm",
        "freeradius-krb5-3.0.25-2.oe2203sp1.aarch64.rpm"
    ],
    "src": [
        "freeradius-3.0.25-2.oe2203sp1.src.rpm"
    ],
    "x86_64": [
        "freeradius-mysql-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-3.0.25-2.oe2203sp1.x86_64.rpm",
        "python3-freeradius-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-devel-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-sqlite-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-postgresql-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-help-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-debuginfo-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-debugsource-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-ldap-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-krb5-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-utils-3.0.25-2.oe2203sp1.x86_64.rpm",
        "freeradius-perl-3.0.25-2.oe2203sp1.x86_64.rpm"
    ]
}