Homepage

Incorrect Default Permissions The advisory has been revoked - it doesn't affect any version of package freeradius  (opens in a new tab)

Threat Intelligence

EPSS
0.35% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-FREERADIUS-1386071
  • published26 Jul 2021
  • disclosed1 May 2019
Report a new vulnerability Found a mistake?

Introduced: 1 May 2019

CVE-2019-10143  (opens in a new tab)
CWE-276  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream freeradius package and not the freeradius package as distributed by RHEL.

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."

References