Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2018-11574 →
DEBIAN-CVE-2018-11574
Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure,...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the refuse-app option are unaffected.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
ppp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-2+3"}]}]
Debian:13
ppp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-2+3"}]}]
Debian:14
ppp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-2+3"}]}]
Références
- advisory security-tracker.debian.org