Merge pull request #67 from basvandervlies/CVE-2024-3596/send_message…

…_authenticator_back freeradius CVE-2024-3596 enhancement
privacyidea · Aug 1, 2024 · c675312 · c675312
2 parents 06e8bc6 + 86513c0
commit c675312
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/privacyidea_radius.pm b/privacyidea_radius.pm
@@ -441,6 +441,12 @@ sub authenticate {
     } elsif ( $Config->{ADD_EMPTY_PASS} =~ /true/i ) {
         $params{"pass"} = "";
     }
+
+    # Security enhancement sned Message-Authenticator back
+    if ( exists( $RAD_REQUEST{'Message-Authenticator'} )) {
+        $RAD_REPLY{'Message-Authenticator'} = $RAD_REQUEST{'Message-Authenticator'};
+    }
+
     # URL encode username and password
     my $uri = URI::Encode->new( { encode_reserved => 0 } );
     $params{"user"} = $uri->encode($params{"user"});