{"id":"MGASA-2015-0291","summary":"Updated freeradius package fixes security vulnerability","details":"The FreeRADIUS server relies on OpenSSL to perform certificate validation,\nincluding Certificate Revocation List (CRL) checks. The FreeRADIUS usage\nof OpenSSL, in CRL application, limits the checks to leaf certificates,\ntherefore not detecting revocation of intermediate CA certificates. An\nunexpired client certificate, issued by an intermediate CA with a revoked\ncertificate, is therefore accepted by FreeRADIUS (CVE-2015-4680).\n\nThe freeradius package has been updated to version 2.2.8, which fixes this\nissue, as well as the failure to run on Mageia 5 due to an OpenSSL issue.\n","modified":"2026-04-16T06:26:14.562083872Z","published":"2015-07-28T21:01:59Z","upstream":["CVE-2015-4680"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2015-0291.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=16175"},{"type":"WEB","url":"http://freeradius.org/security.html"},{"type":"WEB","url":"http://freeradius.org/press/index.html#2.2.8"},{"type":"ADVISORY","url":"http://www.ocert.org/advisories/ocert-2015-008.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=16176"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=16175"}],"affected":[{"package":{"name":"freeradius","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/freeradius?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0291.json"}},{"package":{"name":"freeradius","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/freeradius?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-1.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0291.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}