[v3.0] FreeRADIUS: insufficent CRL application (CVE-2015-4680)
The FreeRADIUS server is an open source project that provides a RADIUS
implementation.
The FreeRADIUS server relies on OpenSSL to perform certificate
validation,
including Certificate Revocation List (CRL) checks. The FreeRADIUS usage
of
OpenSSL, in CRL application, limits the checks to leaf certificates,
therefore not detecting revocation of intermediate CA certificates.
An unexpired client certificate, issued by an intermediate CA with a
revoked
certificate, is therefore accepted by FreeRADIUS.
Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf
certificate CRL
checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks
on the
complete trust chain.
The FreeRADIUS project advises that the recommended configuration is to
use
self-signed CAs for all EAP-TLS methods.
Affected version:
FreeRADIUS <= 2.2.7, <= 3.0.8
Fixed version:
FreeRADIUS >= 2.2.8, >= 3.0.9
Reference: http://seclists.org/oss-sec/2015/q2/776
(from redmine: issue id 4379, created on 2015-06-23, closed on 2017-05-17)
- Relations:
- parent #4377
- Changesets:
- Revision 21a501bc on 2015-12-04T12:22:45Z:
main/freeradius: security upgrade to 2.2.9 (CVE-2015-4680). Fixes #4379