Candidate: CVE-2015-4680
PublicDate: 2017-04-05 17:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4680
 http://freeradius.org/security.html
 http://www.ocert.org/advisories/ocert-2015-008.html
Description:
 FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly
 check revocation of intermediate CA certificates.
Ubuntu-Description:
Notes:
 tyhicks> Upstream states that the recommended configuration is not affected.
  Only configurations using certs from a public CA are affected and upstream
  says that such configurations are not recommended.
 mdeslaur> we will not be fixing this issue in Ubuntu 14.04 LTS. Users are
 mdeslaur> advised to follow upstream recommendations or to update to a
 mdeslaur> later Ubuntu release.
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=789623
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N [7.5 HIGH]

Patches_freeradius:
 upstream: https://github.com/FreeRADIUS/freeradius-server/commit/5e698b407dcac2bc45cf03484bac4398109d25c3
upstream_freeradius: needed
precise_freeradius: ignored (reached end-of-life)
precise/esm_freeradius: DNE (precise was needed)
trusty_freeradius: ignored
trusty/esm_freeradius: DNE (trusty was ignored)
utopic_freeradius: ignored (reached end-of-life)
vivid_freeradius: ignored (reached end-of-life)
vivid/stable-phone-overlay_freeradius: DNE
vivid/ubuntu-core_freeradius: DNE
wily_freeradius: ignored (reached end-of-life)
xenial_freeradius: not-affected (2.2.8+dfsg-0.1build2)
esm-infra/xenial_freeradius: not-affected (2.2.8+dfsg-0.1build2)
yakkety_freeradius: not-affected (2.2.8+dfsg-0.1build2)
zesty_freeradius: not-affected (3.0.12+dfsg-4ubuntu1)
devel_freeradius: not-affected (3.0.12+dfsg-4ubuntu1)