diff options
| author | Haixiao Yan <haixiao.yan.cn@windriver.com> | 2024-11-18 15:07:49 +0800 |
|---|---|---|
| committer | Armin Kuster <akuster808@gmail.com> | 2024-12-08 14:54:19 -0500 |
| commit | feb37930707107748a31300acb5f30189b7232a3 (patch) | |
| tree | 181fef6bfd4b21fd6524d4a28fc38c08e3a180e7 /meta-python/recipes-devtools/python/python3-ntplib_0.4.0.bb | |
| parent | adf635944c6a2f63b5772ceaa5411be84a9b3711 (diff) | |
| download | meta-openembedded-feb37930707107748a31300acb5f30189b7232a3.tar.gz | |
freeradius: upgrade 3.0.21 -> 3.0.27
ChangeLog:
https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_27
Configuration changes:
BlastRADIUS mitigations have been added to the "security" section. See
require_message_authenticator and also limit_proxy_state.
BlastRADIUS mitigations have been added to radclient. See man radclient,
and the -b option.
Security fixes:
CVE-2024-3596:
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a
local attacker who can modify any valid Response (Access-Accept,
Access-Reject, or Access-Challenge) to any other response using a
chosen-prefix collision attack against MD5 Response Authenticator signature.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-3596
https://www.freeradius.org/security/
https://www.blastradius.fail/
https://www.inkbridgenetworks.com/web/content/2557?unique=47be02c8aed46c53b0765db185320249ad873d95
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
[Drop CVE-2024-3596 patch backported early]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'meta-python/recipes-devtools/python/python3-ntplib_0.4.0.bb')
0 files changed, 0 insertions, 0 deletions