CVE-2018-11574

Priority
Description
Improper input validation together with an integer overflow in the EAP-TLS
protocol implementation in PPPD may cause a crash, information disclosure,
or authentication bypass. This implementation is distributed as a patch for
PPPD 0.91, and includes the affected eap.c and eap-tls.c files.
Configurations that use the `refuse-app` option are unaffected.
Assigned-to
mdeslaur
Notes
mdeslaurthe EAP-TLS patch is an Ubuntu-specific change in earlier releases
Package
Source: ppp (LP Ubuntu Debian)
Upstream:released (2.4.7-2+3)
Ubuntu 12.04 ESM (Precise Pangolin):not-affected (code not present)
Ubuntu 14.04 ESM (Trusty Tahr):released (2.4.5-5.1ubuntu2.3)
Ubuntu 16.04 LTS (Xenial Xerus):released (2.4.7-1+2ubuntu1.16.04.1)
Ubuntu 18.04 LTS (Bionic Beaver):released (2.4.7-2+2ubuntu1.1)
More Information

Updated: 2020-09-10 05:49:12 UTC (commit 81a23a978c4436cd99e1d040e9e73e9146876281)