Pam_radius package with BlastRADIUS vulnerability fix

Ask Fedora
1

I am trying to install pam_radius package with BlastRADIUS vulnerability fix.
I executed following commands,
sudo subscription-manager repos --enable codeready-builder-for-rhel-9-$(arch)-rpms

sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm

sudo dnf install pam_radius

sudo dnf upgrade --refresh --advisory=FEDORA-2024-29a74ac2b0

This pam_radius module does not add the required ‘message-authenticator’ attribute in radius requests.

The version of pam_radius is, ‘2.0.0-3.el9’.
How do I get the latest pam_radius package (which uses latest source code from freeradius.org and has fix for BlastRADIUS vulnerability) installed.

2

What OS are you using? Is it Fedora or RHEL or something else?

3

It is RHEL 9.5

4

Suggest you raise a ticker against pam_radius to prompt the maintainer to package a newer version then 2.0.0-3 in the Fedora bug tracker.
I assume that is what you are after.

See How to file a bug :: Fedora Docs