Marked for autoremoval on 22 December: #936558high
Version 3.0.20+dfsg-1 of freeradius is marked for autoremoval from testing on Sun 22 Dec 2019. It is affected by #936558. You should try to prevent the removal by fixing these RC bugs.
The package has not entered testing even though the delay is over
normal
The package has not entered testing even though the 2-day delay is over.Check why.
The current maintainer is looking for someone who can help with
the maintenance of this package. If you are interested in this
package, please consider helping out. One way you can help is
offer to be a co-maintainer or triage bugs in the BTS. Please see bug number #933376 for more information.
CVE-2019-13456: In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.
CVE-2019-11235: FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
CVE-2019-11234: FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
Migration status for freeradius (3.0.20+dfsg-1 to 3.0.20+dfsg-3): BLOCKED: Cannot migrate due to another item, which is blocked (please check which dependencies are stuck)
![[bug history graph]](https://qa.debian.org/data/bts/graphs/f/freeradius.png){kind=link}