FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freeradius | Apr 30, 2019 | Apr 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-postgresqlUpgrade freeradiusUpgrade freeradius-perlUpgrade freeradius-pythonUpgrade freeradius-utilsUpgrade freeradius-docUpgrade freeradius-sqliteUpgrade freeradius-mysqlUpgrade freeradius-develUpgrade freeradius-unixODBCUpgrade freeradius-debuginfoUpgrade freeradius-krb5Upgrade freeradius-ldap | Apr 27, 2020 | Apr 22, 2019 |
| Centos_linux | — | Upgrade freeradius-utilsUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-debugsourceUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-pythonUpgrade freeradius-perl-debuginfoUpgrade freeradius-develUpgrade freeradius-ldapUpgrade freeradius-perlUpgrade freeradius-postgresqlUpgrade freeradius-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradiusUpgrade freeradius-utils-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-restUpgrade freeradius-mysql-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-krb5Upgrade freeradius-mysqlUpgrade freeradius-ldap-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-doc | May 17, 2019 | Apr 22, 2019 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Apr 22, 2019 |
| Oracle_linux | — | Upgrade freeradius-postgresqlUpgrade freeradius-restUpgrade freeradiusUpgrade freeradius-krb5Upgrade freeradius-utilsUpgrade freeradius-perlUpgrade freeradius-docUpgrade freeradius-pythonUpgrade freeradius-sqliteUpgrade freeradius-mysqlUpgrade freeradius-unixODBCUpgrade freeradius-ldapUpgrade freeradius-devel | Jul 21, 2020 | Apr 10, 2019 |
| Redhat_linux | — | Upgrade freeradius-mysql-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradius-krb5Upgrade freeradius-rest-debuginfoUpgrade freeradius-develUpgrade freeradius-unixODBCUpgrade freeradius-mysqlUpgrade freeradius-utils-debuginfoUpgrade freeradius-utilsUpgrade freeradius-postgresqlUpgrade freeradius-perl-debuginfoUpgrade freeradius-restUpgrade freeradius-docUpgrade freeradius-ldapUpgrade freeradius-sqliteUpgrade freeradius-debugsourceUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-pythonUpgrade freeradiusUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-perl | May 10, 2019 | Apr 22, 2019 |
| Suse | — | Upgrade freeradius-server-krb5Upgrade freeradius-serverUpgrade freeradius-server-ldapUpgrade freeradius-server-python3Upgrade freeradius-server-docUpgrade freeradius-server-pythonUpgrade freeradius-server-libsUpgrade freeradius-server-mysqlUpgrade freeradius-server-perlUpgrade freeradius-server-utilsUpgrade freeradius-server-develUpgrade freeradius-server-sqliteUpgrade freeradius-server-postgresql | Apr 26, 2019 | Apr 22, 2019 |
| Ubuntu | — | Upgrade freeradius | May 2, 2019 | Apr 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub