In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freeradius-restUpgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade freeradiusUpgrade python3-freeradiusUpgrade freeradius-docUpgrade freeradius-krb5Upgrade freeradius-sqliteUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-ldapUpgrade freeradius-mysql | May 4, 2022 | Mar 21, 2020 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-unixODBCUpgrade freeradius-docUpgrade freeradius-krb5Upgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade freeradiusUpgrade freeradius-ldapUpgrade freeradius-debuginfoUpgrade freeradius-develUpgrade freeradius-mysqlUpgrade freeradius-sqliteUpgrade freeradius-pythonUpgrade freeradius-utils | Oct 28, 2020 | Mar 21, 2020 |
| Centos_linux | — | Upgrade python3-freeradiusUpgrade freeradius-debugsourceUpgrade freeradius-perlUpgrade freeradius-mysql-debuginfoUpgrade freeradius-krb5Upgrade python3-freeradius-debuginfoUpgrade freeradius-restUpgrade freeradius-mysqlUpgrade freeradius-docUpgrade freeradius-rest-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-krb5-debuginfoUpgrade freeradiusUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-ldapUpgrade freeradius-develUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-utilsUpgrade freeradius-perl-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-ldap-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-pythonUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-utils-debuginfo | Oct 1, 2020 | Mar 21, 2020 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade freeradius | Nov 3, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade freeradius | Sep 28, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freeradius | Aug 31, 2020 | Mar 21, 2020 |
| Oracle_linux | — | Upgrade freeradius-restUpgrade freeradius-ldapUpgrade freeradius-sqliteUpgrade freeradius-develUpgrade freeradius-pythonUpgrade freeradius-utilsUpgrade freeradius-docUpgrade python3-freeradiusUpgrade freeradius-unixODBCUpgrade freeradius-krb5Upgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade freeradiusUpgrade freeradius-mysql | Oct 7, 2020 | Nov 14, 2019 |
| Redhat_linux | — | Upgrade freeradius-ldap-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradius-mysqlUpgrade python3-freeradius-debuginfoUpgrade freeradius-develUpgrade freeradius-perlUpgrade freeradius-rest-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-docUpgrade freeradius-mysql-debuginfoUpgrade freeradius-krb5Upgrade freeradius-debuginfoUpgrade freeradius-debugsourceUpgrade freeradius-ldapUpgrade freeradiusUpgrade freeradius-restUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-utils-debuginfoUpgrade freeradius-postgresqlUpgrade python3-freeradiusUpgrade freeradius-perl-debuginfoUpgrade freeradius-utilsUpgrade freeradius-pythonUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-unixODBC | Oct 1, 2020 | Mar 21, 2020 |
| Rocky_linux | — | Upgrade freeradius-sqliteUpgrade freeradius-restUpgrade freeradius-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradius-develUpgrade python3-freeradius-debuginfoUpgrade freeradius-perlUpgrade python3-freeradiusUpgrade freeradius-docUpgrade freeradius-rest-debuginfoUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-krb5Upgrade freeradius-debugsourceUpgrade freeradius-mysql-debuginfoUpgrade freeradiusUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-postgresqlUpgrade freeradius-ldapUpgrade freeradius-perl-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-ldap-debuginfoUpgrade freeradius-utilsUpgrade freeradius-utils-debuginfo | Mar 12, 2024 | Mar 21, 2020 |
| Suse | — | Upgrade freeradius-server-ldapUpgrade freeradius-server-libsUpgrade freeradius-server-utilsUpgrade freeradius-server-pythonUpgrade freeradius-server-perlUpgrade freeradius-server-docUpgrade freeradius-server-develUpgrade freeradius-server-krb5Upgrade freeradius-server-mysqlUpgrade freeradius-server-postgresqlUpgrade freeradius-server-python3Upgrade freeradius-serverUpgrade freeradius-server-sqlite | Apr 18, 2020 | Mar 21, 2020 |
| Ubuntu | — | Upgrade freeradiusUpgrade freeradius (Ubuntu Pro) | Jan 4, 2023 | Mar 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub