[OpenWrt-Devel] [CC 14.07] freeradius2: Security update (CVE-2015-4680)

jow at openwrt.org jow at openwrt.org
Tue Jul 21 14:20:32 EDT 2015


The freeradius2 package has been rebuilt and was uploaded to the Barrier
Breaker 14.07 repository due to a reported security issue.


VERSION

2.2.5-2 => 2.2.5-2.1


CHANGELOG

[Mon, 20 Jul 2015 10:38:03 +0200 de5e37a]

Backport upstream commit 5e698b407dcac2bc45cf03484bac4398109d25c3 to fix
missing intermediate certificate validation in Freeradius2.

Advisory:

The FreeRADIUS server relies on OpenSSL to perform certificate
validation, including Certificate Revocation List (CRL) checks. The
FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to
leaf certificates, therefore not detecting revocation of intermediate CA
certificates.

An unexpired client certificate, issued by an intermediate CA with a
revoked certificate, is therefore accepted by FreeRADIUS.

Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate
CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on
the complete trust chain.

The FreeRADIUS project advises that the recommended configuration is to
use self-signed CAs for all EAP-TLS methods.


CHANGES

 net/freeradius2/Makefile                      |    4 +-
 .../patches/012-CVE-2015-4680.patch           |   71 +++++++++++++++++
 2 files changed, 73 insertions(+), 2 deletions(-)


REFERENCES

 * https://github.com/openwrt/packages/commit/de5e37ac5be3d44c335faa9652bf4ce15784f4ad
_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel



More information about the openwrt-devel mailing list