CVE-2019-10143 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2019-10143 Interim 1 28 2023-02-13T01:26:51Z current 2021-05-30T14:26:39Z 2023-02-13T01:26:51Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2019-10143 ** DISPUTED ** It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue." The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES for SAP Applications 11 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Server 11 SP3 LTSS SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Module for Server Applications 15 freeradius-server freeradius-server-devel freeradius-server-doc freeradius-server-krb5 freeradius-server-ldap freeradius-server-libs freeradius-server-mysql freeradius-server-perl freeradius-server-postgresql freeradius-server-python freeradius-server-sqlite freeradius-server-utils freeradius-server as a component of SLES for SAP Applications 11 SP3 freeradius-server as a component of SUSE Linux Enterprise High Performance Computing 12 SP4 freeradius-server as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-devel as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-krb5 as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-ldap as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-libs as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-mysql as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-perl as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-postgresql as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-python as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-sqlite as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server-utils as a component of SUSE Linux Enterprise Module for Server Applications 15 freeradius-server as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata freeradius-server as a component of SUSE Linux Enterprise Server 11 SP3 LTSS freeradius-server as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata freeradius-server as a component of SUSE Linux Enterprise Server 11 SP4 LTSS freeradius-server as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-doc as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-krb5 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-ldap as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-libs as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-mysql as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-perl as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-postgresql as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-python as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-sqlite as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server-utils as a component of SUSE Linux Enterprise Server 12 SP1-LTSS freeradius-server as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-doc as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-krb5 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-ldap as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-libs as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-mysql as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-perl as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-postgresql as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-python as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-sqlite as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server-utils as a component of SUSE Linux Enterprise Server 12 SP2-LTSS freeradius-server as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-doc as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-krb5 as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-ldap as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-libs as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-mysql as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-perl as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-postgresql as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-python as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-sqlite as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server-utils as a component of SUSE Linux Enterprise Server 12 SP3 freeradius-server as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-doc as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-krb5 as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-ldap as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-libs as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-mysql as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-perl as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-postgresql as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-python as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-sqlite as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server-utils as a component of SUSE Linux Enterprise Server 12 SP4 freeradius-server as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-doc as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-krb5 as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-ldap as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-libs as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-mysql as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-perl as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-postgresql as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-python as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-sqlite as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server-utils as a component of SUSE Linux Enterprise Server 12-LTSS freeradius-server as a component of SUSE Linux Enterprise Server for SAP Applications 12 freeradius-server as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-doc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-krb5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-ldap as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-libs as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-mysql as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-perl as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-postgresql as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-python as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-sqlite as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server-utils as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 freeradius-server as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-doc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-krb5 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-ldap as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-libs as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-mysql as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-perl as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-postgresql as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-python as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-sqlite as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-utils as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 freeradius-server-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 freeradius-server as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 ** DISPUTED ** It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue." CVE-2019-10143 SLES for SAP Applications 11 SP3:freeradius-server SUSE Linux Enterprise Module for Server Applications 15:freeradius-server SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-devel SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-krb5 SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-ldap SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-libs SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-mysql SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-perl SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-postgresql SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-python SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-sqlite SUSE Linux Enterprise Module for Server Applications 15:freeradius-server-utils SUSE Linux Enterprise Server 11 SP1 for Teradata:freeradius-server SUSE Linux Enterprise Server 11 SP3 LTSS:freeradius-server SUSE Linux Enterprise Server 11 SP3 for Teradata:freeradius-server SUSE Linux Enterprise Server 11 SP4 LTSS:freeradius-server SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-doc SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-krb5 SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-ldap SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-libs SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-mysql SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-perl SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-postgresql SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-python SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-sqlite SUSE Linux Enterprise Server 12 SP1-LTSS:freeradius-server-utils SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-doc SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-krb5 SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-ldap SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-libs SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-mysql SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-perl SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-postgresql SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-python SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-sqlite SUSE Linux Enterprise Server 12 SP2-LTSS:freeradius-server-utils SUSE Linux Enterprise Server 12 SP3:freeradius-server SUSE Linux Enterprise Server 12 SP3:freeradius-server-doc SUSE Linux Enterprise Server 12 SP3:freeradius-server-krb5 SUSE Linux Enterprise Server 12 SP3:freeradius-server-ldap SUSE Linux Enterprise Server 12 SP3:freeradius-server-libs SUSE Linux Enterprise Server 12 SP3:freeradius-server-mysql SUSE Linux Enterprise Server 12 SP3:freeradius-server-perl SUSE Linux Enterprise Server 12 SP3:freeradius-server-postgresql SUSE Linux Enterprise Server 12 SP3:freeradius-server-python SUSE Linux Enterprise Server 12 SP3:freeradius-server-sqlite SUSE Linux Enterprise Server 12 SP3:freeradius-server-utils SUSE Linux Enterprise Server 12-LTSS:freeradius-server SUSE Linux Enterprise Server 12-LTSS:freeradius-server-doc SUSE Linux Enterprise Server 12-LTSS:freeradius-server-krb5 SUSE Linux Enterprise Server 12-LTSS:freeradius-server-ldap SUSE Linux Enterprise Server 12-LTSS:freeradius-server-libs SUSE Linux Enterprise Server 12-LTSS:freeradius-server-mysql SUSE Linux Enterprise Server 12-LTSS:freeradius-server-perl SUSE Linux Enterprise Server 12-LTSS:freeradius-server-postgresql SUSE Linux Enterprise Server 12-LTSS:freeradius-server-python SUSE Linux Enterprise Server 12-LTSS:freeradius-server-sqlite SUSE Linux Enterprise Server 12-LTSS:freeradius-server-utils SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-doc SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-krb5 SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-ldap SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-libs SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-mysql SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-perl SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-postgresql SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-python SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-sqlite SUSE Linux Enterprise Server for SAP Applications 12 SP2:freeradius-server-utils SUSE Linux Enterprise Server for SAP Applications 12:freeradius-server SUSE Linux Enterprise Software Development Kit 12 SP3:freeradius-server SUSE Linux Enterprise Software Development Kit 12 SP3:freeradius-server-devel SUSE Linux Enterprise High Performance Computing 12 SP4:freeradius-server SUSE Linux Enterprise Server 12 SP4:freeradius-server SUSE Linux Enterprise Server 12 SP4:freeradius-server-doc SUSE Linux Enterprise Server 12 SP4:freeradius-server-krb5 SUSE Linux Enterprise Server 12 SP4:freeradius-server-ldap SUSE Linux Enterprise Server 12 SP4:freeradius-server-libs SUSE Linux Enterprise Server 12 SP4:freeradius-server-mysql SUSE Linux Enterprise Server 12 SP4:freeradius-server-perl SUSE Linux Enterprise Server 12 SP4:freeradius-server-postgresql SUSE Linux Enterprise Server 12 SP4:freeradius-server-python SUSE Linux Enterprise Server 12 SP4:freeradius-server-sqlite SUSE Linux Enterprise Server 12 SP4:freeradius-server-utils SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-doc SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-krb5 SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-ldap SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-libs SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-mysql SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-perl SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-postgresql SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-python SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-sqlite SUSE Linux Enterprise Server for SAP Applications 12 SP4:freeradius-server-utils moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H