Every CVE Search/ Get API key

CVE-2015-4680

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of...

7.5 HighFix available

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.79%Up 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

Record
CVE-2015-4680
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-295
Updated
2026-11-02
CVE List No score

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

Record
CVE-2015-4680
Updated
2026-11-02
EUVDEUVD-2015-4699 No score

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

Record
EUVD-2015-4699
Updated
2026-11-03
GitHub AdvisoriesGHSA-58q5-m5pm-jwpv 7.5

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of...

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

Record
GHSA-58q5-m5pm-jwpv
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV 7.5

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

Record
CVE-2015-4680
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2015-4680 7.5

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

Record
DEBIAN-CVE-2015-4680
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2015-4680 7.5

FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

Record
UBUNTU-CVE-2015-4680
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVMGASA-2015-0291 No score

Updated freeradius package fixes security vulnerability

The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates. An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS (CVE-2015-4680).

The freeradius package has been updated to version 2.2.8, which fixes this issue, as well as the failure to run on Mageia 5 due to an OpenSSL issue.

Record
MGASA-2015-0291
Updated
2026-11-02
OSVopenSUSE-SU-2024:10767-1 No score

freeradius-server-3.0.23-1.5 on GA media

These are all security issues fixed in the freeradius-server-3.0.23-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10767-1
Updated
2026-11-02
OSVSUSE-SU-2017:0102-1 No score

Security update for freeradius-server

This update of freeradius-server fixes several issues.

Security issue fixed:

  • CVE-2015-4680: Fixed Insufficent CRL application for intermediate certificates (bsc#935573)

Non security issues fixed:

  • Allows FreeRadius Server to start on SUSE Linux Enterprise Server 12 SP2 systems by relaxing a too strict openssl version check. (bsc#1013311)
  • Fixed radclient error free() invalid pointer (bsc#911886)
  • Fixed failing rebuild of freeradius-server package (bsc#951404)
Record
SUSE-SU-2017:0102-1
Updated
2026-11-02
OSVSUSE-SU-2017:1777-1 No score

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

  • CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate authentication bypass. (bnc#1041445)
  • CVE-2015-4680: Add a configuration option to allow checking of all intermediate certificates for revocations. (bnc#935573)

The following non security issue was fixed:

  • Cannot create table radpostauth because of deprecated TIMESTAMP(14) syntax. (bsc#912873)
Record
SUSE-SU-2017:1777-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freeradius
Debian:12
 before 2.2.8+dfsg-0.1
2.2.8+dfsg-0.1
freeradius
Debian:13
 before 2.2.8+dfsg-0.1
2.2.8+dfsg-0.1
freeradius
Debian:14
 before 2.2.8+dfsg-0.1
2.2.8+dfsg-0.1
freeradius
Debian:7
From an advisory covering 3 CVEs
 before 2.1.12+dfsg-1.2+deb7u1, plus listed versions
2.1.12+dfsg-1.2
2.1.12+dfsg-1.2+deb7u1
freeradius
Mageia:4
 before 2.2.8-1.mga4
2.2.8-1.mga4
freeradius
Mageia:5
 before 2.2.8-1.mga5
2.2.8-1.mga5
freeradius-server
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 3.0.3-14.1
3.0.3-14.1
freeradius-server
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 3.0.3-14.1
3.0.3-14.1
freeradius-server
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 3.0.3-14.1
3.0.3-14.1
freeradius-server
SUSE:Linux Enterprise Server 12 SP1
 before 3.0.3-14.1
3.0.3-14.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
freeradius-server
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 3.0.3-14.1
3.0.3-14.1
freeradius-server
SUSE:Linux Enterprise Server 12 SP2
 before 3.0.3-14.1
3.0.3-14.1
freeradius-server
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.0.3-14.1
3.0.3-14.1
freeradius-server
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 2 CVEs
 before 2.1.1-7.24.1
2.1.1-7.24.1
freeradius-server
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 2 CVEs
 before 2.1.1-7.24.1
2.1.1-7.24.1
freeradius-server
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 2 CVEs
 before 2.1.1-7.24.1
2.1.1-7.24.1
freeradius-server
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 3.0.23-1.5
3.0.23-1.5

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-4680 is a high vulnerability (CVSS 7.5) in Freeradius, published July 28, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. Fixed in freeradius 2.2.8+dfsg-0.1.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open