[v3.2] FreeRADIUS: insufficent CRL application (CVE-2015-4680)
The FreeRADIUS server is an open source project that provides a RADIUS
The FreeRADIUS server relies on OpenSSL to perform certificate
including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of
OpenSSL, in CRL application, limits the checks to leaf certificates,
therefore not detecting revocation of intermediate CA certificates.
An unexpired client certificate, issued by an intermediate CA with a
certificate, is therefore accepted by FreeRADIUS.
Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf
checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the
complete trust chain.
The FreeRADIUS project advises that the recommended configuration is to
self-signed CAs for all EAP-TLS methods.
FreeRADIUS <= 2.2.7, <= 3.0.8
FreeRADIUS >= 2.2.8, >= 3.0.9
(from redmine: issue id 4381, created on 2015-06-23, closed on 2019-05-03)
- parent #4377
- Revision 1794998b by Natanael Copa on 2015-07-07T19:45:05Z:
main/freeradius: security fix for CVE-2015-4680 ref #4377 fixes #4381 (cherry picked from commit 1314c0d82fee33213ea17cc7805bdf3a60efac78)