Blast-RADIUS CVE-2024-3596

[zivua]

Hello -- will freeradius-client receive the Message-Authenticator updates needed to address CVE-2024-3596 ?

[alandekok]

We plan on releasing a new version of freeradius-client shortly.

[sunil-1989]

Hi @alandekok ,

I am just curious about when the new release will be available? By any chance do you know ?

[lelandmills]

Alan, I also am interested in blast radius fix on the client library. Any update?

[lelandmills]

message_authenticator.patch
Alan, if nobody's gotten to it yet, I believe this patch contains the necessary changes for blast radius to the client. It also has assorted checks/fixes. The message authenticator pieces alone are contained in include/freeradius-client.h and lib/: rc-md5.h, rc-md5.c, buildreq.c, options.h, sendserver.c. You'll recognize some of it. :)

[sunil-1989]

Hi @alandekok
Is there a new version of freeradius-client coming up in upcoming weeks for this vulnerability ??

[DouglasRoyds]

Leland, I think you'll also need to move the declaration of fd outside the #if statement for the case that HAVE_GETENTROPY is defined:

int        fd = -1;
#if defined(HAVE_GETENTROPY)
   ...