FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freeradius | Apr 30, 2019 | Apr 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-unixODBCUpgrade freeradius-ldapUpgrade freeradius-krb5Upgrade freeradius-debuginfoUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradius-mysqlUpgrade freeradius-docUpgrade freeradiusUpgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade freeradius-python | Apr 27, 2020 | Apr 22, 2019 |
| Centos_linux | — | Upgrade freeradius-utilsUpgrade freeradius-perlUpgrade freeradius-ldapUpgrade freeradius-sqliteUpgrade freeradius-perl-debuginfoUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-develUpgrade freeradius-debuginfoUpgrade freeradius-debugsourceUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-pythonUpgrade freeradius-postgresqlUpgrade freeradius-krb5Upgrade freeradius-utils-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradiusUpgrade freeradius-mysqlUpgrade freeradius-restUpgrade freeradius-rest-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-docUpgrade freeradius-ldap-debuginfo | May 17, 2019 | Apr 22, 2019 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Apr 22, 2019 |
| Oracle_linux | — | Upgrade freeradius-postgresqlUpgrade freeradius-restUpgrade freeradius-utilsUpgrade freeradiusUpgrade freeradius-docUpgrade freeradius-perlUpgrade freeradius-krb5Upgrade freeradius-pythonUpgrade freeradius-develUpgrade freeradius-sqliteUpgrade freeradius-mysqlUpgrade freeradius-unixODBCUpgrade freeradius-ldap | Jul 21, 2020 | Apr 10, 2019 |
| Redhat_linux | — | Upgrade freeradius-krb5-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-krb5Upgrade freeradius-utils-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-rest-debuginfoUpgrade freeradius-develUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-pythonUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-docUpgrade freeradius-restUpgrade freeradius-postgresqlUpgrade freeradius-perl-debuginfoUpgrade freeradius-utilsUpgrade freeradiusUpgrade freeradius-debugsourceUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-ldapUpgrade freeradius-perl | May 10, 2019 | Apr 22, 2019 |
| Suse | — | Upgrade freeradius-server-pythonUpgrade freeradius-serverUpgrade freeradius-server-ldapUpgrade freeradius-server-docUpgrade freeradius-server-python3Upgrade freeradius-server-krb5Upgrade freeradius-server-utilsUpgrade freeradius-server-mysqlUpgrade freeradius-server-sqliteUpgrade freeradius-server-develUpgrade freeradius-server-postgresqlUpgrade freeradius-server-perlUpgrade freeradius-server-libs | Apr 26, 2019 | Apr 22, 2019 |
| Ubuntu | — | Upgrade freeradius | May 2, 2019 | Apr 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub