CVE-2015-4680

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates. An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS (CVE-2015-4680).

The freeradius package has been updated to version 2.2.8, which fixes this issue, as well as the failure to run on Mageia 5 due to an OpenSSL issue.

These are all security issues fixed in the freeradius-server-3.0.23-1.5 package on the GA media of openSUSE Tumbleweed.

This update of freeradius-server fixes several issues.

Security issue fixed:

• CVE-2015-4680: Fixed Insufficent CRL application for intermediate certificates (bsc#935573)

Non security issues fixed:

• Allows FreeRadius Server to start on SUSE Linux Enterprise Server 12 SP2 systems by relaxing a too strict openssl version check. (bsc#1013311)
• Fixed radclient error free() invalid pointer (bsc#911886)
• Fixed failing rebuild of freeradius-server package (bsc#951404)

This update for freeradius-server fixes the following issues:

• CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate authentication bypass. (bnc#1041445)
• CVE-2015-4680: Add a configuration option to allow checking of all intermediate certificates for revocations. (bnc#935573)

The following non security issue was fixed:

• Cannot create table radpostauth because of deprecated TIMESTAMP(14) syntax. (bsc#912873)