CVE-2015-4680
published 2017-04-05CVE-2015-4680: FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
PriorityP336high7.5CVSS 3.0
AVNACLPRNUINSUCNIHAN
EPSS
1.79%
75.9th percentile
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freeradius | < freeradius 2.2.8+dfsg-0.1 (bookworm) | freeradius 2.2.8+dfsg-0.1 (bookworm) |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | — | — |
| freeradius | freeradius | >= 0 < 2.2.8+dfsg-0.1 | 2.2.8+dfsg-0.1 |
| freeradius | freeradius | >= 0 < 2.2.8+dfsg-0.1 | 2.2.8+dfsg-0.1 |
| freeradius | freeradius | >= 0 < 2.2.8+dfsg-0.1 | 2.2.8+dfsg-0.1 |
| freeradius | freeradius | >= 0 < 2.2.8+dfsg-0.1 | 2.2.8+dfsg-0.1 |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
freeradius: insufficent CRL application
vendor_redhat·2015-06-22·CVSS 7.5
CVE-2015-4680 [HIGH] CWE-299 freeradius: insufficent CRL application
freeradius: insufficent CRL application
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
Package: freeradius (Red Hat Enterprise Linux 5) - Will not fix
Package: freeradius2 (Red Hat Enterprise Linux 5) - Will not fix
Package: freeradius (Red Hat Enterprise Linux 6) - Will not fix
Package: freeradius (Red Hat Enterprise Linux 7) - Will not fix
Debian
CVE-2015-4680: freeradius - FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check rev...
vendor_debian·2015·CVSS 7.5
CVE-2015-4680 [HIGH] CVE-2015-4680: freeradius - FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check rev...
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
Scope: local
bookworm: resolved (fixed in 2.2.8+dfsg-0.1)
bullseye: resolved (fixed in 2.2.8+dfsg-0.1)
forky: resolved (fixed in 2.2.8+dfsg-0.1)
sid: resolved (fixed in 2.2.8+dfsg-0.1)
trixie: resolved (fixed in 2.2.8+dfsg-0.1)
GHSA
GHSA-58q5-m5pm-jwpv: FreeRADIUS 2
ghsa_unreviewed·2022-05-14
CVE-2015-4680 [HIGH] CWE-295 GHSA-58q5-m5pm-jwpv: FreeRADIUS 2
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
OSV
CVE-2015-4680: FreeRADIUS 2
osv·2017-04-05·CVSS 7.5
CVE-2015-4680 [HIGH] CVE-2015-4680: FreeRADIUS 2
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-4680 freeradius: insufficent CRL application
bugzilla·2015-06-23·CVSS 7.5
CVE-2015-4680 [HIGH] CVE-2015-4680 freeradius: insufficent CRL application
CVE-2015-4680 freeradius: insufficent CRL application
The FreeRADIUS server relies on OpenSSL to perform certificate validation,
including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of
OpenSSL, in CRL application, limits the checks to leaf certificates,
therefore not detecting revocation of intermediate CA certificates.
An unexpired client certificate, issued by an intermediate CA with a revoked
certificate, is therefore accepted by FreeRADIUS.
Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL
checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the
complete trust chain.
The FreeRADIUS project advises that the recommended configuration is to use
self-signed CAs for all EAP-TLS methods.
Upstream fixes:
- 2.x.x: https://github.
Bugzilla
CVE-2015-4680 freeradius: insufficent CRL application [fedora-all]
bugzilla·2015-06-23·CVSS 7.5
CVE-2015-4680 [HIGH] CVE-2015-4680 freeradius: insufficent CRL application [fedora-all]
CVE-2015-4680 freeradius: insufficent CRL application [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. Whi
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00010.htmlhttp://packetstormsecurity.com/files/132415/FreeRADIUS-Insufficient-CRL-Application.htmlhttp://www.ocert.org/advisories/ocert-2015-008.htmlhttp://www.securityfocus.com/archive/1/535810/100/0/threadedhttp://www.securityfocus.com/bid/75327http://www.securitytracker.com/id/1032690https://bugzilla.redhat.com/show_bug.cgi?id=1234975http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00010.htmlhttp://packetstormsecurity.com/files/132415/FreeRADIUS-Insufficient-CRL-Application.htmlhttp://www.ocert.org/advisories/ocert-2015-008.htmlhttp://www.securityfocus.com/archive/1/535810/100/0/threadedhttp://www.securityfocus.com/bid/75327http://www.securitytracker.com/id/1032690https://bugzilla.redhat.com/show_bug.cgi?id=1234975
2017-04-05
Published