In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freeradius-ldapUpgrade freeradius-sqliteUpgrade freeradius-utilsUpgrade freeradius-develUpgrade freeradius-mysqlUpgrade freeradius-perlUpgrade freeradius-krb5Upgrade freeradiusUpgrade freeradius-docUpgrade python3-freeradiusUpgrade freeradius-postgresqlUpgrade freeradius-rest | May 4, 2022 | Mar 21, 2020 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-mysqlUpgrade freeradius-utilsUpgrade freeradius-develUpgrade freeradius-sqliteUpgrade freeradius-ldapUpgrade freeradius-debuginfoUpgrade freeradius-pythonUpgrade freeradius-unixODBCUpgrade freeradius-perlUpgrade freeradius-docUpgrade freeradius-krb5Upgrade freeradiusUpgrade freeradius-postgresql | Oct 28, 2020 | Mar 21, 2020 |
| Centos_linux | — | Upgrade freeradius-ldapUpgrade freeradius-perl-debuginfoUpgrade freeradius-pythonUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-utilsUpgrade freeradius-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-utils-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-develUpgrade freeradius-debugsourceUpgrade freeradius-mysql-debuginfoUpgrade freeradius-krb5Upgrade freeradiusUpgrade freeradius-perlUpgrade python3-freeradiusUpgrade freeradius-docUpgrade freeradius-krb5-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-restUpgrade freeradius-mysqlUpgrade freeradius-sqliteUpgrade python3-freeradius-debuginfo | Oct 1, 2020 | Mar 21, 2020 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade freeradius | Nov 3, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade freeradius | Sep 28, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freeradius | Aug 31, 2020 | Mar 21, 2020 |
| Oracle_linux | — | Upgrade freeradius-perlUpgrade freeradius-postgresqlUpgrade freeradius-mysqlUpgrade freeradius-krb5Upgrade freeradiusUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradius-develUpgrade freeradius-docUpgrade freeradius-pythonUpgrade freeradius-unixODBCUpgrade freeradius-ldapUpgrade freeradius-restUpgrade python3-freeradius | Oct 7, 2020 | Nov 14, 2019 |
| Redhat_linux | — | Upgrade freeradius-unixODBC-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-krb5Upgrade freeradius-debuginfoUpgrade freeradius-utils-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradius-docUpgrade freeradius-mysqlUpgrade freeradius-ldap-debuginfoUpgrade freeradius-perlUpgrade python3-freeradius-debuginfoUpgrade freeradius-develUpgrade freeradius-perl-debuginfoUpgrade freeradius-restUpgrade freeradius-pythonUpgrade freeradius-unixODBCUpgrade freeradiusUpgrade freeradius-ldapUpgrade freeradius-postgresqlUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-utilsUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-debugsourceUpgrade freeradius-sqliteUpgrade python3-freeradius | Oct 1, 2020 | Mar 21, 2020 |
| Rocky_linux | — | Upgrade freeradius-postgresqlUpgrade freeradius-docUpgrade freeradius-ldapUpgrade freeradius-ldap-debuginfoUpgrade freeradius-utilsUpgrade freeradius-utils-debuginfoUpgrade freeradiusUpgrade freeradius-debugsourceUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-mysqlUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-krb5Upgrade python3-freeradiusUpgrade freeradius-sqliteUpgrade freeradius-perlUpgrade python3-freeradius-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradius-develUpgrade freeradius-debuginfoUpgrade freeradius-rest | Mar 12, 2024 | Mar 21, 2020 |
| Suse | — | Upgrade freeradius-server-utilsUpgrade freeradius-server-ldapUpgrade freeradius-server-pythonUpgrade freeradius-server-libsUpgrade freeradius-server-docUpgrade freeradius-server-perlUpgrade freeradius-server-sqliteUpgrade freeradius-server-develUpgrade freeradius-server-python3Upgrade freeradius-serverUpgrade freeradius-server-postgresqlUpgrade freeradius-server-krb5Upgrade freeradius-server-mysql | Apr 18, 2020 | Mar 21, 2020 |
| Ubuntu | — | Upgrade freeradiusUpgrade freeradius (Ubuntu Pro) | Jan 4, 2023 | Mar 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub