FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freeradius | Apr 30, 2019 | Apr 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade freeradiusUpgrade freeradius-pythonUpgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade freeradius-mysqlUpgrade freeradius-docUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradius-ldapUpgrade freeradius-krb5Upgrade freeradius-unixODBCUpgrade freeradius-debuginfoUpgrade freeradius-devel | Apr 27, 2020 | Apr 22, 2019 |
| Centos_linux | — | Upgrade freeradius-sqliteUpgrade freeradius-debugsourceUpgrade freeradius-perlUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-develUpgrade freeradius-pythonUpgrade freeradius-debuginfoUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradius-perl-debuginfoUpgrade freeradius-krb5Upgrade freeradius-docUpgrade freeradius-krb5-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-ldap-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-restUpgrade freeradius-utils-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradiusUpgrade freeradius-mysql | May 17, 2019 | Apr 22, 2019 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Apr 22, 2019 |
| Oracle_linux | — | Upgrade freeradius-pythonUpgrade freeradius-develUpgrade freeradius-mysqlUpgrade freeradius-unixODBCUpgrade freeradius-ldapUpgrade freeradius-sqliteUpgrade freeradius-utilsUpgrade freeradius-postgresqlUpgrade freeradiusUpgrade freeradius-perlUpgrade freeradius-krb5Upgrade freeradius-restUpgrade freeradius-doc | Jul 21, 2020 | Apr 10, 2019 |
| Redhat_linux | — | Upgrade freeradius-utils-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-rest-debuginfoUpgrade freeradius-krb5Upgrade freeradius-unixODBC-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-krb5-debuginfoUpgrade freeradius-develUpgrade freeradius-postgresqlUpgrade freeradius-docUpgrade freeradius-perl-debuginfoUpgrade freeradius-ldapUpgrade freeradius-debugsourceUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-restUpgrade freeradius-pythonUpgrade freeradius-perlUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-sqliteUpgrade freeradiusUpgrade freeradius-utils | May 10, 2019 | Apr 22, 2019 |
| Suse | — | Upgrade freeradius-server-python3Upgrade freeradius-server-ldapUpgrade freeradius-server-krb5Upgrade freeradius-server-pythonUpgrade freeradius-server-docUpgrade freeradius-serverUpgrade freeradius-server-utilsUpgrade freeradius-server-libsUpgrade freeradius-server-perlUpgrade freeradius-server-postgresqlUpgrade freeradius-server-mysqlUpgrade freeradius-server-develUpgrade freeradius-server-sqlite | Apr 26, 2019 | Apr 22, 2019 |
| Ubuntu | — | Upgrade freeradius | May 2, 2019 | Apr 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub