FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freeradius | Apr 30, 2019 | Apr 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-ldapUpgrade freeradius-krb5Upgrade freeradius-develUpgrade freeradius-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-pythonUpgrade freeradius-utilsUpgrade freeradiusUpgrade freeradius-sqliteUpgrade freeradius-mysqlUpgrade freeradius-docUpgrade freeradius-perlUpgrade freeradius-postgresql | Apr 27, 2020 | Apr 22, 2019 |
| Centos_linux | — | Upgrade freeradius-perlUpgrade freeradius-postgresqlUpgrade freeradius-debugsourceUpgrade freeradius-develUpgrade freeradius-perl-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-ldapUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-pythonUpgrade freeradius-sqliteUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-utilsUpgrade freeradius-mysql-debuginfoUpgrade freeradiusUpgrade freeradius-restUpgrade freeradius-unixODBCUpgrade freeradius-krb5-debuginfoUpgrade freeradius-utils-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-rest-debuginfoUpgrade freeradius-docUpgrade freeradius-ldap-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-krb5 | May 17, 2019 | Apr 22, 2019 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Apr 22, 2019 |
| Oracle_linux | — | Upgrade freeradius-sqliteUpgrade freeradius-develUpgrade freeradius-unixODBCUpgrade freeradius-pythonUpgrade freeradius-mysqlUpgrade freeradius-ldapUpgrade freeradius-restUpgrade freeradiusUpgrade freeradius-postgresqlUpgrade freeradius-krb5Upgrade freeradius-docUpgrade freeradius-utilsUpgrade freeradius-perl | Jul 21, 2020 | Apr 10, 2019 |
| Redhat_linux | — | Upgrade freeradius-utilsUpgrade freeradius-postgresql-debuginfoUpgrade freeradiusUpgrade freeradius-pythonUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-perlUpgrade freeradius-docUpgrade freeradius-restUpgrade freeradius-sqliteUpgrade freeradius-postgresqlUpgrade freeradius-debugsourceUpgrade freeradius-ldapUpgrade freeradius-mysqlUpgrade freeradius-krb5-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-krb5Upgrade freeradius-utils-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-develUpgrade freeradius-debuginfo | May 10, 2019 | Apr 22, 2019 |
| Suse | — | Upgrade freeradius-serverUpgrade freeradius-server-ldapUpgrade freeradius-server-python3Upgrade freeradius-server-krb5Upgrade freeradius-server-docUpgrade freeradius-server-pythonUpgrade freeradius-server-perlUpgrade freeradius-server-sqliteUpgrade freeradius-server-mysqlUpgrade freeradius-server-utilsUpgrade freeradius-server-develUpgrade freeradius-server-postgresqlUpgrade freeradius-server-libs | Apr 26, 2019 | Apr 22, 2019 |
| Ubuntu | — | Upgrade freeradius | May 2, 2019 | Apr 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub