FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freeradius | Apr 30, 2019 | Apr 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-develUpgrade freeradius-krb5Upgrade freeradius-ldapUpgrade freeradiusUpgrade freeradius-docUpgrade freeradius-perlUpgrade freeradius-utilsUpgrade freeradius-pythonUpgrade freeradius-sqliteUpgrade freeradius-mysqlUpgrade freeradius-postgresql | Apr 27, 2020 | Apr 22, 2019 |
| Centos_linux | — | Upgrade freeradius-debugsourceUpgrade freeradius-sqliteUpgrade freeradius-ldapUpgrade freeradius-perlUpgrade freeradius-postgresqlUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-pythonUpgrade freeradius-postgresql-debuginfoUpgrade freeradiusUpgrade freeradius-mysqlUpgrade freeradius-krb5Upgrade freeradius-utils-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-restUpgrade freeradius-ldap-debuginfoUpgrade freeradius-docUpgrade freeradius-rest-debuginfo | May 17, 2019 | Apr 22, 2019 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Apr 22, 2019 |
| Oracle_linux | — | Upgrade freeradius-krb5Upgrade freeradius-docUpgrade freeradius-utilsUpgrade freeradius-perlUpgrade freeradius-restUpgrade freeradiusUpgrade freeradius-postgresqlUpgrade freeradius-develUpgrade freeradius-mysqlUpgrade freeradius-pythonUpgrade freeradius-sqliteUpgrade freeradius-ldapUpgrade freeradius-unixODBC | Jul 21, 2020 | Apr 10, 2019 |
| Redhat_linux | — | Upgrade freeradius-debuginfoUpgrade freeradius-develUpgrade freeradius-krb5Upgrade freeradius-utils-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-krb5-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-pythonUpgrade freeradius-perlUpgrade freeradius-restUpgrade freeradius-utilsUpgrade freeradiusUpgrade freeradius-docUpgrade freeradius-ldapUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-postgresqlUpgrade freeradius-perl-debuginfoUpgrade freeradius-debugsourceUpgrade freeradius-postgresql-debuginfo | May 10, 2019 | Apr 22, 2019 |
| Suse | — | Upgrade freeradius-server-docUpgrade freeradius-server-python3Upgrade freeradius-server-pythonUpgrade freeradius-server-krb5Upgrade freeradius-server-ldapUpgrade freeradius-serverUpgrade freeradius-server-utilsUpgrade freeradius-server-libsUpgrade freeradius-server-mysqlUpgrade freeradius-server-postgresqlUpgrade freeradius-server-sqliteUpgrade freeradius-server-develUpgrade freeradius-server-perl | Apr 26, 2019 | Apr 22, 2019 |
| Ubuntu | — | Upgrade freeradius | May 2, 2019 | Apr 22, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub