In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freeradius-sqliteUpgrade freeradius-utilsUpgrade freeradius-mysqlUpgrade freeradius-ldapUpgrade freeradius-develUpgrade freeradius-restUpgrade freeradius-postgresqlUpgrade freeradius-krb5Upgrade freeradiusUpgrade python3-freeradiusUpgrade freeradius-perlUpgrade freeradius-doc | May 4, 2022 | Mar 21, 2020 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-debuginfoUpgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-pythonUpgrade freeradius-mysqlUpgrade freeradius-sqliteUpgrade freeradius-ldapUpgrade freeradius-krb5Upgrade freeradius-unixODBCUpgrade freeradius-perlUpgrade freeradius-postgresqlUpgrade freeradiusUpgrade freeradius-doc | Oct 28, 2020 | Mar 21, 2020 |
| Centos_linux | — | Upgrade freeradius-pythonUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-utilsUpgrade freeradius-ldap-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-ldapUpgrade freeradius-unixODBCUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-develUpgrade freeradius-debuginfoUpgrade freeradius-utils-debuginfoUpgrade freeradius-perlUpgrade freeradius-rest-debuginfoUpgrade freeradius-restUpgrade python3-freeradiusUpgrade freeradiusUpgrade freeradius-mysqlUpgrade python3-freeradius-debuginfoUpgrade freeradius-debugsourceUpgrade freeradius-docUpgrade freeradius-mysql-debuginfoUpgrade freeradius-krb5Upgrade freeradius-sqliteUpgrade freeradius-krb5-debuginfo | Oct 1, 2020 | Mar 21, 2020 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade freeradius | Nov 3, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade freeradius | Sep 28, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freeradius | Aug 31, 2020 | Mar 21, 2020 |
| Oracle_linux | — | Upgrade freeradius-develUpgrade freeradius-docUpgrade freeradius-unixODBCUpgrade python3-freeradiusUpgrade freeradius-ldapUpgrade freeradius-restUpgrade freeradius-pythonUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradiusUpgrade freeradius-postgresqlUpgrade freeradius-mysqlUpgrade freeradius-perlUpgrade freeradius-krb5 | Oct 7, 2020 | Nov 14, 2019 |
| Redhat_linux | — | Upgrade freeradius-utilsUpgrade freeradius-debugsourceUpgrade freeradius-unixODBCUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-pythonUpgrade freeradius-postgresqlUpgrade freeradius-restUpgrade freeradiusUpgrade freeradius-ldapUpgrade freeradius-sqliteUpgrade python3-freeradiusUpgrade freeradius-rest-debuginfoUpgrade python3-freeradius-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-krb5-debuginfoUpgrade freeradius-utils-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-perlUpgrade freeradius-develUpgrade freeradius-docUpgrade freeradius-krb5 | Oct 1, 2020 | Mar 21, 2020 |
| Rocky_linux | — | Upgrade freeradius-debuginfoUpgrade python3-freeradius-debuginfoUpgrade freeradius-perlUpgrade freeradius-krb5-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-restUpgrade python3-freeradiusUpgrade freeradius-develUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-krb5Upgrade freeradius-utilsUpgrade freeradius-rest-debuginfoUpgrade freeradius-debugsourceUpgrade freeradius-utils-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradiusUpgrade freeradius-mysqlUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-ldapUpgrade freeradius-ldap-debuginfoUpgrade freeradius-docUpgrade freeradius-unixODBC | Mar 12, 2024 | Mar 21, 2020 |
| Suse | — | Upgrade freeradius-server-libsUpgrade freeradius-server-ldapUpgrade freeradius-server-utilsUpgrade freeradius-server-pythonUpgrade freeradius-server-mysqlUpgrade freeradius-server-perlUpgrade freeradius-server-sqliteUpgrade freeradius-server-docUpgrade freeradius-server-develUpgrade freeradius-server-postgresqlUpgrade freeradius-server-python3Upgrade freeradius-serverUpgrade freeradius-server-krb5 | Apr 18, 2020 | Mar 21, 2020 |
| Ubuntu | — | Upgrade freeradius (Ubuntu Pro)Upgrade freeradius | Jan 4, 2023 | Mar 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub