In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freeradius-develUpgrade freeradius-restUpgrade python3-freeradiusUpgrade freeradius-unixODBCUpgrade freeradius-krb5Upgrade freeradius-mysqlUpgrade freeradius-ldapUpgrade freeradius-docUpgrade freeradius-postgresqlUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradiusUpgrade freeradius-perl | May 15, 2023 | Jan 17, 2023 |
| Alpine Linux | — | Upgrade freeradius | Mar 26, 2024 | Jan 17, 2023 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-develUpgrade freeradius-ldapUpgrade freeradius-docUpgrade freeradius-krb5Upgrade freeradius-debuginfoUpgrade freeradius-utilsUpgrade freeradius-unixODBCUpgrade freeradius-postgresqlUpgrade freeradius-mysqlUpgrade freeradius-sqliteUpgrade freeradius-pythonUpgrade freeradius-perlUpgrade freeradius | Mar 7, 2023 | Jan 17, 2023 |
| Centos_linux | — | Upgrade freeradius-utils-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-debugsourceUpgrade freeradius-ldap-debuginfoUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-krb5Upgrade freeradius-perlUpgrade python3-freeradiusUpgrade freeradius-mysql-debuginfoUpgrade freeradius-docUpgrade freeradius-restUpgrade freeradius-unixODBC-debuginfoUpgrade freeradiusUpgrade freeradius-utilsUpgrade freeradius-krb5-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-develUpgrade freeradius-perl-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-ldapUpgrade freeradius-postgresql-debuginfoUpgrade python3-freeradius-debuginfo | May 15, 2023 | Jan 17, 2023 |
| Debian | — | Upgrade freeradius | Feb 27, 2023 | Jan 17, 2023 |
| Oracle_linux | — | Upgrade freeradius-krb5Upgrade freeradius-mysqlUpgrade freeradius-restUpgrade freeradius-unixODBCUpgrade freeradius-perlUpgrade freeradiusUpgrade freeradius-develUpgrade freeradius-postgresqlUpgrade freeradius-utilsUpgrade freeradius-ldapUpgrade python3-freeradiusUpgrade freeradius-docUpgrade freeradius-sqlite | May 17, 2023 | Apr 22, 2022 |
| Redhat_linux | — | Upgrade freeradius-rest-debuginfoUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-mysqlUpgrade freeradius-develUpgrade freeradius-unixODBCUpgrade freeradius-mysql-debuginfoUpgrade freeradius-utilsUpgrade freeradius-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-ldapUpgrade freeradius-debugsourceUpgrade freeradius-restUpgrade python3-freeradiusUpgrade freeradius-perlUpgrade freeradius-postgresqlUpgrade freeradius-utils-debuginfoUpgrade freeradius-docUpgrade python3-freeradius-debuginfoUpgrade freeradius-sqlite-debuginfoUpgrade freeradiusUpgrade freeradius-ldap-debuginfoUpgrade freeradius-krb5Upgrade freeradius-unixODBC-debuginfoUpgrade freeradius-krb5-debuginfoNo solution exists | May 15, 2023 | Jan 17, 2023 |
| Rocky_linux | — | Upgrade freeradius-restUpgrade freeradius-docUpgrade freeradiusUpgrade freeradius-perlUpgrade python3-freeradiusUpgrade freeradius-krb5Upgrade freeradius-sqliteUpgrade freeradius-postgresqlUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradius-mysqlUpgrade freeradius-unixODBCUpgrade freeradius-devel | Jun 29, 2026 | Jun 26, 2026 |
| Suse | — | Upgrade freeradius-serverUpgrade freeradius-server-ldap-schemasUpgrade freeradius-server-utilsUpgrade freeradius-server-krb5Upgrade freeradius-server-libsUpgrade freeradius-server-sqliteUpgrade freeradius-server-perlUpgrade freeradius-server-mysqlUpgrade freeradius-server-postgresqlUpgrade freeradius-server-docUpgrade freeradius-server-develUpgrade freeradius-server-python | Dec 28, 2022 | Dec 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub