This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-10143 →

DEBIAN-CVE-2019-10143

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has cont...

Original description

The description as published by the source.

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 freeradius

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 freeradius

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6+dfsg-3"}]}]

Debian:14 freeradius

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6+dfsg-3"}]}]

References

advisory security-tracker.debian.org