CVE-2018-11574

Priority
Description
Improper input validation together with an integer overflow in the EAP-TLS
protocol implementation in PPPD may cause a crash, information disclosure,
or authentication bypass. This implementation is distributed as a patch for
PPPD 0.91, and includes the affected eap.c and eap-tls.c files.
Configurations that use the `refuse-app` option are unaffected.
Notes
 mdeslaur> the EAP-TLS patch is an Ubuntu-specific change in earlier releases
Assigned-to
mdeslaur
Package
Source: ppp (LP Ubuntu Debian)
Upstream:released (2.4.7-2+3)
Ubuntu 12.04 ESM (Precise Pangolin):not-affected (code not present)
Ubuntu 14.04 LTS (Trusty Tahr):released (2.4.5-5.1ubuntu2.3)
Ubuntu 16.04 LTS (Xenial Xerus):released (2.4.7-1+2ubuntu1.16.04.1)
Ubuntu 18.04 LTS (Bionic Beaver):released (2.4.7-2+2ubuntu1.1)
Ubuntu 18.10 (Cosmic Cuttlefish):released (2.4.7-2+3ubuntu1)
Ubuntu 19.04 (Disco Dingo):released (2.4.7-2+3ubuntu1)
More Information

Updated: 2019-03-19 12:30:20 UTC (commit 15472795df7e9de45b82f2d36b8b419b939f97b2)