VULN/vuln-ubuntu
1
0 Fork 0
Code Pull Requests Actions Activity
Files
a51ba77ec8ca9f8e91f783601acdfce81895b8bd
vuln-ubuntu/data/osv/cve/2017/UBUNTU-CVE-2017-9148.json
T

282 lines
8.1 KiB
JSON
Raw Blame History

{
"schema_version": "1.7.0",
"id": "UBUNTU-CVE-2017-9148",
"details": "The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.",
"aliases": [],
"upstream": [
"CVE-2017-9148"
],
"related": [
"USN-3316-1"
],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"published": "2017-05-29T00:00:00Z",
"modified": "2025-07-16T04:52:07Z",
"affected": [
{
"package": {
"ecosystem": "Ubuntu:14.04:LTS",
"name": "freeradius",
"purl": "pkg:deb/ubuntu/freeradius@2.1.12+dfsg-1.2ubuntu8.1?arch=source&distro=trusty"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.12+dfsg-1.2ubuntu8.1"
}
]
}
],
"versions": [
"2.1.12+dfsg-1.2ubuntu5",
"2.1.12+dfsg-1.2ubuntu6",
"2.1.12+dfsg-1.2ubuntu7",
"2.1.12+dfsg-1.2ubuntu8"
],
"ecosystem_specific": {
"binaries": [
{
"binary_name": "freeradius",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-common",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-dbg",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-dialupadmin",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-iodbc",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-iodbc-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-krb5",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-krb5-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-ldap",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-ldap-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-mysql",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-mysql-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-postgresql",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-postgresql-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-utils",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "freeradius-utils-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "libfreeradius-dev",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "libfreeradius-dev-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "libfreeradius2",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
},
{
"binary_name": "libfreeradius2-dbgsym",
"binary_version": "2.1.12+dfsg-1.2ubuntu8.1"
}
],
"availability": "No subscription required"
}
},
{
"package": {
"ecosystem": "Ubuntu:16.04:LTS",
"name": "freeradius",
"purl": "pkg:deb/ubuntu/freeradius@2.2.8+dfsg-0.1build2?arch=source&distro=xenial"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.8+dfsg-0.1build2"
}
]
}
],
"versions": [
"2.1.12+dfsg-1.3ubuntu5",
"2.2.8+dfsg-0.1",
"2.2.8+dfsg-0.1build1"
],
"ecosystem_specific": {
"binaries": [
{
"binary_name": "freeradius",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-common",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-dbg",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-iodbc",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-iodbc-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-krb5",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-krb5-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-ldap",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-ldap-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-mysql",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-mysql-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-postgresql",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-postgresql-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-utils",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "freeradius-utils-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "libfreeradius-dev",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "libfreeradius-dev-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "libfreeradius2",
"binary_version": "2.2.8+dfsg-0.1build2"
},
{
"binary_name": "libfreeradius2-dbgsym",
"binary_version": "2.2.8+dfsg-0.1build2"
}
],
"availability": "No subscription required"
}
}
],
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2017-9148"
},
{
"type": "REPORT",
"url": "http://www.openwall.com/lists/oss-security/2017/05/29/1"
},
{
"type": "REPORT",
"url": "http://freeradius.org/security.html#session-resumption-2017"
},
{
"type": "REPORT",
"url": "http://freeradius.org/security.html"
},
{
"type": "REPORT",
"url": "http://seclists.org/oss-sec/2017/q2/342"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-3316-1"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9148"
}
],
"withdrawn": "2025-07-18T16:44:00Z"
}
View Git Blame Copy Permalink