CVE-2018-11574

Priority
Description
Improper input validation together with an integer overflow in the EAP-TLS
protocol implementation in PPPD may cause a crash, information disclosure,
or authentication bypass. This implementation is distributed as a patch for
PPPD 0.91, and includes the affected eap.c and eap-tls.c files.
Configurations that use the `refuse-app` option are unaffected.
Notes
 mdeslaur> the EAP-TLS patch is an Ubuntu-specific change in earlier releases
Assigned-to
mdeslaur
Package
Source: ppp (LP Ubuntu Debian)
Upstream:released (2.4.7-2+3)
Ubuntu 12.04 ESM (Precise Pangolin):not-affected (code not present)
Ubuntu 14.04 LTS (Trusty Tahr):released (2.4.5-5.1ubuntu2.3)
Ubuntu 16.04 LTS (Xenial Xerus):released (2.4.7-1+2ubuntu1.16.04.1)
Ubuntu 18.04 LTS (Bionic Beaver):released (2.4.7-2+2ubuntu1.1)
Ubuntu 18.10 (Cosmic Cuttlefish):released (2.4.7-2+3ubuntu1)
Ubuntu 19.04 (Disco Dingo):released (2.4.7-2+3ubuntu1)
More Information

Updated: 2018-11-08 16:15:02 UTC (commit c62a932fd322f44757e5f89e1e1d6fd51b55200a)