Your message dated Tue, 12 Sep 2023 18:47:08 +0000
with message-id <[email protected]>
and subject line Bug#1043282: fixed in freeradius 3.2.1+dfsg-4+deb12u1
has caused the Debian Bug report #1043282,
regarding freeradius: TLS-Client-Cert-Common-Name contains incorrect value
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1043282: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1043282
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: freeradius
Version: 3.2.1+dfsg-4
Severity: important
Dear Maintainer,
We have a setup with TLS authentication where we use the CN of the client
certificate ti check in LDAP if that CN has access to our VPN service. This was
working fine in bullseye but breaks in bookworm. The reason is that
TLS-Client-Cert-Common-Name no longer contains the CN from the client
certificate but the CN from the CA certificate.
This is a known bug in freeradius 3.2.1 (see
https://github.com/FreeRADIUS/freeradius-server/issues/4785) and is fixed in
3.2.2. I REALLY hope this can be fixed ASAP in bookworm because we have had to
skip the LDAP check to get our VPN working again and that is not a good thing.
-- System Information:
Debian Release: 12.1
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.1.0-10-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=locale: Cannot set
LC_ALL to default locale: No such file or directory
UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages freeradius depends on:
ii freeradius-common 3.2.1+dfsg-4
ii freeradius-config 3.2.1+dfsg-4
ii libc6 2.36-9+deb12u1
ii libcrypt1 1:4.4.33-2
ii libct4 1.3.17+ds-2
ii libfreeradius3 3.2.1+dfsg-4
ii libgdbm6 1.23-3
ii libjson-c5 0.16-2
ii libpam0g 1.5.2-6
ii libperl5.36 5.36.0-7
ii libreadline8 8.2-1.3
ii libsqlite3-0 3.40.1-2
ii libssl3 3.0.9-1
ii libsystemd0 252.12-1~deb12u1
ii libtalloc2 2.4.0-f2
ii libwbclient0 2:4.17.9+dfsg-0+deb12u3
ii lsb-base 11.6
ii sysvinit-utils [lsb-base] 3.06-4
Versions of packages freeradius recommends:
ii freeradius-utils 3.2.1+dfsg-4
Versions of packages freeradius suggests:
pn freeradius-krb5 <none>
ii freeradius-ldap 3.2.1+dfsg-4
pn freeradius-mysql <none>
pn freeradius-postgresql <none>
pn freeradius-python3 <none>
ii snmp 5.9.3+dfsg-2
-- debconf information excluded
--- End Message ---
--- Begin Message ---
Source: freeradius
Source-Version: 3.2.1+dfsg-4+deb12u1
Done: Bernhard Schmidt <[email protected]>
We believe that the bug you reported is fixed in the latest version of
freeradius, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bernhard Schmidt <[email protected]> (supplier of updated freeradius package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 19 Aug 2023 00:26:34 +0200
Source: freeradius
Architecture: source
Version: 3.2.1+dfsg-4+deb12u1
Distribution: bookworm
Urgency: medium
Maintainer: Debian FreeRADIUS Packaging Team
<[email protected]>
Changed-By: Bernhard Schmidt <[email protected]>
Closes: 1043282
Changes:
freeradius (3.2.1+dfsg-4+deb12u1) bookworm; urgency=medium
.
* Add d/gbp.conf for bookworm stable branch
* Cherry-Pick two upstream commits to fix TLS-Client-Cert-Common-Name
contains incorrect value (Closes: #1043282)
Checksums-Sha1:
32278d6a846212b26631b1cb367f68216b1bc652 3645
freeradius_3.2.1+dfsg-4+deb12u1.dsc
c4115ad2919a086ea70784a10290b521be8f7d30 58980
freeradius_3.2.1+dfsg-4+deb12u1.debian.tar.xz
a7fe3b122ac023dea0ab0121b8f4168f23b17779 20035
freeradius_3.2.1+dfsg-4+deb12u1_amd64.buildinfo
Checksums-Sha256:
be08d4784ddb8438364b07ad50efe3355b3e4b000feab0fbb5bf97cd2dbad0f4 3645
freeradius_3.2.1+dfsg-4+deb12u1.dsc
5cdc33bfd2b996a2aaa0e581c94f65a193de056f5160084880d5e57770ff7481 58980
freeradius_3.2.1+dfsg-4+deb12u1.debian.tar.xz
9ea2f81bc87447a2a476bd583080daccf5c4c97b12f054a0a57ad626d1459875 20035
freeradius_3.2.1+dfsg-4+deb12u1_amd64.buildinfo
Files:
826460258498468843c40906de918610 3645 net optional
freeradius_3.2.1+dfsg-4+deb12u1.dsc
d1bf25ee6b7aec3caa274cd1c94a0c1b 58980 net optional
freeradius_3.2.1+dfsg-4+deb12u1.debian.tar.xz
5633701298d9f7170abb78a0aa0d0b3d 20035 net optional
freeradius_3.2.1+dfsg-4+deb12u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmT/ax4RHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJMwAQ//XW1M6vTfmWRoG7fJBQD+fD2S0gEyWLu8
/ZRn8K/5RVhcbwMQhhqnYqubTXwiFclZbrYEEo2ALbNo3SzE4Nvz7zVGJJ9UHhkI
F32JF5pPB1VlNerLt15SJba31i7ZVMw0MD9Wbiys51F59SAjJSDVVIWfdJJMbSfG
qgeYLRL1es4oul4nqgLy5eomj8twaICbuk5T4h5rd6W2R8/v65RZfcv1KWRyq+Ha
OewEO0di7FPyzUNz/GYbpDub5xH2pKTu0gWpyreB2g0fRqzQGJYD7u2xc9bkI/Bz
pTngV/JLDhrqLMuAeGyvuQ0ofo+MUjd9iR86lU3npS1U+w2wJgEfeoKGnxvdmOoP
e0nI9zuwbzi9oRt11OXbFeOPMpDPyRB8JarFMRHLu1MRjxKL8Ly4Cq4dRL9dZ3X3
8J2Man+u+TKNiduYQbjlBloZQtEykZPa1Yp7zWab6EkC6j8/l0GjsDWEZuPA2nd4
jcJUc+fy9t1z56GUyv+166Tdl65OasReoTg1mySCzSu3PiRl5N1pKmxD8nbMRaKd
k4JaqTEfL4OzZLbeoehEQemWb28uD8rovWpVYzam7QofAHP5epjfylP+WAsSWxYK
gUEnRiLuhewxZKK/sxW6K8JuUWL//l054ottfz19z80BVHX7mTG1oFvcdrbFCsjN
7K7R5f8SFdc=
=P/E8
-----END PGP SIGNATURE-----
--- End Message ---
