In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freeradius-develUpgrade freeradius-ldapUpgrade freeradius-sqliteUpgrade freeradius-utilsUpgrade freeradius-mysqlUpgrade freeradius-perlUpgrade python3-freeradiusUpgrade freeradiusUpgrade freeradius-docUpgrade freeradius-krb5Upgrade freeradius-restUpgrade freeradius-postgresql | May 4, 2022 | Mar 21, 2020 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-krb5Upgrade freeradius-unixODBCUpgrade freeradiusUpgrade freeradius-postgresqlUpgrade freeradius-docUpgrade freeradius-perlUpgrade freeradius-ldapUpgrade freeradius-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-pythonUpgrade freeradius-mysql | Oct 28, 2020 | Mar 21, 2020 |
| Centos_linux | — | Upgrade freeradius-krb5-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-krb5Upgrade freeradius-sqliteUpgrade freeradius-debugsourceUpgrade freeradius-docUpgrade python3-freeradiusUpgrade freeradius-perlUpgrade freeradius-restUpgrade python3-freeradius-debuginfoUpgrade freeradiusUpgrade freeradius-mysqlUpgrade freeradius-perl-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-pythonUpgrade freeradius-postgresqlUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-ldapUpgrade freeradius-utils-debuginfo | Oct 1, 2020 | Mar 21, 2020 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade freeradius | Nov 3, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade freeradius | Sep 28, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freeradius | Aug 31, 2020 | Mar 21, 2020 |
| Oracle_linux | — | Upgrade freeradius-restUpgrade freeradius-ldapUpgrade freeradius-pythonUpgrade freeradius-docUpgrade python3-freeradiusUpgrade freeradius-unixODBCUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradiusUpgrade freeradius-mysqlUpgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade freeradius-krb5 | Oct 7, 2020 | Nov 14, 2019 |
| Redhat_linux | — | Upgrade freeradius-debugsourceUpgrade freeradius-ldapUpgrade freeradius-unixODBCUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-sqliteUpgrade python3-freeradiusUpgrade freeradius-utilsUpgrade freeradius-pythonUpgrade freeradiusUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-restUpgrade freeradius-krb5Upgrade freeradius-utils-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-krb5-debuginfoUpgrade python3-freeradius-debuginfoUpgrade freeradius-develUpgrade freeradius-mysql-debuginfoUpgrade freeradius-perlUpgrade freeradius-rest-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-docUpgrade freeradius-unixODBC-debuginfo | Oct 1, 2020 | Mar 21, 2020 |
| Rocky_linux | — | Upgrade freeradius-utils-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-utilsUpgrade freeradius-mysql-debuginfoUpgrade freeradius-krb5Upgrade freeradius-unixODBC-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-ldap-debuginfoUpgrade freeradius-docUpgrade freeradius-perl-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-ldapUpgrade freeradius-debugsourceUpgrade freeradius-postgresql-debuginfoUpgrade freeradiusUpgrade python3-freeradiusUpgrade freeradius-restUpgrade freeradius-krb5-debuginfoUpgrade python3-freeradius-debuginfoUpgrade freeradius-perlUpgrade freeradius-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-devel | Mar 12, 2024 | Mar 21, 2020 |
| Suse | — | Upgrade freeradius-server-krb5Upgrade freeradius-server-python3Upgrade freeradius-server-postgresqlUpgrade freeradius-serverUpgrade freeradius-server-mysqlUpgrade freeradius-server-sqliteUpgrade freeradius-server-perlUpgrade freeradius-server-docUpgrade freeradius-server-develUpgrade freeradius-server-utilsUpgrade freeradius-server-libsUpgrade freeradius-server-pythonUpgrade freeradius-server-ldap | Apr 18, 2020 | Mar 21, 2020 |
| Ubuntu | — | Upgrade freeradiusUpgrade freeradius (Ubuntu Pro) | Jan 4, 2023 | Mar 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub