Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freeradius | Aug 30, 2017 | Sep 18, 2012 |
| Centos_linux | — | Upgrade freeradius2-ldapUpgrade freeradius-mysqlUpgrade freeradius-perlUpgrade freeradius2-postgresqlUpgrade freeradius2-mysqlUpgrade freeradius-krb5Upgrade freeradiusUpgrade freeradius2-pythonUpgrade freeradius2Upgrade freeradius2-unixODBCUpgrade freeradius-postgresqlUpgrade freeradius2-perlUpgrade freeradius-utilsUpgrade freeradius2-krb5Upgrade freeradius-ldapUpgrade freeradius-unixODBCUpgrade freeradius-pythonUpgrade freeradius2-utils | Dec 1, 2016 | Sep 18, 2012 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Sep 18, 2012 |
| Freebsd | — | Upgrade freeradius | Dec 10, 2025 | Sep 11, 2012 |
| Gentoo Linux | — | Upgrade net-dialup/freeradius. | Oct 30, 2017 | Sep 18, 2012 |
| Oracle_linux | — | Upgrade freeradius-ldapUpgrade freeradius2-krb5Upgrade freeradius2-postgresqlUpgrade freeradius-pythonUpgrade freeradius-perlUpgrade freeradius2-perlUpgrade freeradius2-pythonUpgrade freeradius2-ldapUpgrade freeradius-mysqlUpgrade freeradius2-mysqlUpgrade freeradius-krb5Upgrade freeradius-unixODBCUpgrade freeradius-postgresqlUpgrade freeradius2-unixODBCUpgrade freeradiusUpgrade freeradius2Upgrade freeradius-utilsUpgrade freeradius2-utils | Oct 16, 2024 | Sep 18, 2012 |
| Suse | — | Upgrade freeradius-server-krb5Upgrade freeradius-server-develUpgrade freeradius-server-sqliteUpgrade freeradius-server-python3Upgrade freeradius-server-ldapUpgrade freeradius-server-postgresqlUpgrade freeradius-server-docUpgrade freeradius-server-mysqlUpgrade freeradius-server-perlUpgrade freeradius-server-pythonUpgrade freeradius-server-libsUpgrade freeradius-server-utilsUpgrade freeradius-server | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade freeradius | Nov 8, 2024 | Sep 18, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub