Linux · Security advisory · May 24, 2023

ELSA-2023-2870: Security update for 13 packages

ELSA-2023-2870, released May 24, 2023, fixes 3 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0121
68th percentile

Priority of the 3 CVEs

Patch now 0 Urgent 0 High 3 Routine 0

Fixed package versions

ProductReleaseFixed in
freeradiusol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-develol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-docol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-krb5ol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-ldapol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-mysqlol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-perlol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-postgresqlol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-restol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-sqliteol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-unixODBCol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
freeradius-utilsol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9
python3-freeradiusol 80:3.0.20-14.module+el8.8.0+20995+3f8a93b9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-41860 freeradius: FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) ser... 7.5 0.0121 None reported
High CVE-2022-41861 freeradius-memcached: A flaw was found in freeradius 7.5 0.0114 None reported
High CVE-2022-41859 freeradius: FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) ser... 7.5 0.0089 None reported
Showing 1 to 3 of 3 1