In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-freeradiusalma-upgrade-freeradius-develalma-upgrade-freeradius-docalma-upgrade-freeradius-krb5alma-upgrade-freeradius-ldapalma-upgrade-freeradius-mysqlalma-upgrade-freeradius-perlalma-upgrade-freeradius-postgresqlalma-upgrade-freeradius-restalma-upgrade-freeradius-sqlitealma-upgrade-freeradius-unixODBCalma-upgrade-freeradius-utilsalma-upgrade-python3-freeradius | May 4, 2022 | Mar 21, 2020 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-freeradiusamazon-linux-ami-2-upgrade-freeradius-debuginfoamazon-linux-ami-2-upgrade-freeradius-develamazon-linux-ami-2-upgrade-freeradius-docamazon-linux-ami-2-upgrade-freeradius-krb5amazon-linux-ami-2-upgrade-freeradius-ldapamazon-linux-ami-2-upgrade-freeradius-mysqlamazon-linux-ami-2-upgrade-freeradius-perlamazon-linux-ami-2-upgrade-freeradius-postgresqlamazon-linux-ami-2-upgrade-freeradius-pythonamazon-linux-ami-2-upgrade-freeradius-sqliteamazon-linux-ami-2-upgrade-freeradius-unixodbcamazon-linux-ami-2-upgrade-freeradius-utils | Oct 28, 2020 | Mar 21, 2020 | |
| Centos_linux | — | centos-upgrade-freeradiuscentos-upgrade-freeradius-debuginfocentos-upgrade-freeradius-debugsourcecentos-upgrade-freeradius-develcentos-upgrade-freeradius-doccentos-upgrade-freeradius-krb5centos-upgrade-freeradius-krb5-debuginfocentos-upgrade-freeradius-ldapcentos-upgrade-freeradius-ldap-debuginfocentos-upgrade-freeradius-mysqlcentos-upgrade-freeradius-mysql-debuginfocentos-upgrade-freeradius-perlcentos-upgrade-freeradius-perl-debuginfocentos-upgrade-freeradius-postgresqlcentos-upgrade-freeradius-postgresql-debuginfocentos-upgrade-freeradius-pythoncentos-upgrade-freeradius-restcentos-upgrade-freeradius-rest-debuginfocentos-upgrade-freeradius-sqlitecentos-upgrade-freeradius-sqlite-debuginfocentos-upgrade-freeradius-unixodbccentos-upgrade-freeradius-unixodbc-debuginfocentos-upgrade-freeradius-utilscentos-upgrade-freeradius-utils-debuginfocentos-upgrade-python3-freeradiuscentos-upgrade-python3-freeradius-debuginfo | Oct 1, 2020 | Mar 21, 2020 |
| Debian | debian-upgrade-freeradius | Jul 30, 2024 | Mar 21, 2020 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-freeradius | Nov 3, 2020 | Mar 21, 2020 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-freeradius | Sep 28, 2020 | Mar 21, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-freeradius | Aug 31, 2020 | Mar 21, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-freeradiusoracle-linux-upgrade-freeradius-develoracle-linux-upgrade-freeradius-docoracle-linux-upgrade-freeradius-krb5oracle-linux-upgrade-freeradius-ldaporacle-linux-upgrade-freeradius-mysqloracle-linux-upgrade-freeradius-perloracle-linux-upgrade-freeradius-postgresqloracle-linux-upgrade-freeradius-pythonoracle-linux-upgrade-freeradius-restoracle-linux-upgrade-freeradius-sqliteoracle-linux-upgrade-freeradius-unixodbcoracle-linux-upgrade-freeradius-utilsoracle-linux-upgrade-python3-freeradius | Oct 7, 2020 | Nov 14, 2019 |
| Redhat_linux | redhat-upgrade-freeradiusredhat-upgrade-freeradius-debuginforedhat-upgrade-freeradius-debugsourceredhat-upgrade-freeradius-develredhat-upgrade-freeradius-docredhat-upgrade-freeradius-krb5redhat-upgrade-freeradius-krb5-debuginforedhat-upgrade-freeradius-ldapredhat-upgrade-freeradius-ldap-debuginforedhat-upgrade-freeradius-mysqlredhat-upgrade-freeradius-mysql-debuginforedhat-upgrade-freeradius-perlredhat-upgrade-freeradius-perl-debuginforedhat-upgrade-freeradius-postgresqlredhat-upgrade-freeradius-postgresql-debuginforedhat-upgrade-freeradius-pythonredhat-upgrade-freeradius-restredhat-upgrade-freeradius-rest-debuginforedhat-upgrade-freeradius-sqliteredhat-upgrade-freeradius-sqlite-debuginforedhat-upgrade-freeradius-unixodbcredhat-upgrade-freeradius-unixodbc-debuginforedhat-upgrade-freeradius-utilsredhat-upgrade-freeradius-utils-debuginforedhat-upgrade-python3-freeradiusredhat-upgrade-python3-freeradius-debuginfo | Oct 1, 2020 | Mar 21, 2020 | |
| Rocky_linux | rocky-upgrade-freeradiusrocky-upgrade-freeradius-debuginforocky-upgrade-freeradius-debugsourcerocky-upgrade-freeradius-develrocky-upgrade-freeradius-docrocky-upgrade-freeradius-krb5rocky-upgrade-freeradius-krb5-debuginforocky-upgrade-freeradius-ldaprocky-upgrade-freeradius-ldap-debuginforocky-upgrade-freeradius-mysqlrocky-upgrade-freeradius-mysql-debuginforocky-upgrade-freeradius-perlrocky-upgrade-freeradius-perl-debuginforocky-upgrade-freeradius-postgresqlrocky-upgrade-freeradius-postgresql-debuginforocky-upgrade-freeradius-restrocky-upgrade-freeradius-rest-debuginforocky-upgrade-freeradius-sqliterocky-upgrade-freeradius-sqlite-debuginforocky-upgrade-freeradius-unixodbcrocky-upgrade-freeradius-unixodbc-debuginforocky-upgrade-freeradius-utilsrocky-upgrade-freeradius-utils-debuginforocky-upgrade-python3-freeradiusrocky-upgrade-python3-freeradius-debuginfo | Mar 12, 2024 | Mar 21, 2020 | |
| Suse | — | suse-upgrade-freeradius-serversuse-upgrade-freeradius-server-develsuse-upgrade-freeradius-server-docsuse-upgrade-freeradius-server-krb5suse-upgrade-freeradius-server-ldapsuse-upgrade-freeradius-server-libssuse-upgrade-freeradius-server-mysqlsuse-upgrade-freeradius-server-perlsuse-upgrade-freeradius-server-postgresqlsuse-upgrade-freeradius-server-pythonsuse-upgrade-freeradius-server-python3suse-upgrade-freeradius-server-sqlitesuse-upgrade-freeradius-server-utils | Apr 18, 2020 | Mar 21, 2020 |
| Ubuntu | ubuntu-pro-upgrade-freeradiusubuntu-upgrade-freeradius | Jan 4, 2023 | Mar 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub