In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freeradius-develUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradius-mysqlUpgrade freeradius-ldapUpgrade freeradius-postgresqlUpgrade freeradius-krb5Upgrade freeradius-perlUpgrade python3-freeradiusUpgrade freeradiusUpgrade freeradius-docUpgrade freeradius-rest | May 4, 2022 | Mar 21, 2020 |
| Amazon Linux Ami 2 | — | Upgrade freeradiusUpgrade freeradius-perlUpgrade freeradius-unixODBCUpgrade freeradius-docUpgrade freeradius-postgresqlUpgrade freeradius-krb5Upgrade freeradius-mysqlUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradius-develUpgrade freeradius-debuginfoUpgrade freeradius-ldapUpgrade freeradius-python | Oct 28, 2020 | Mar 21, 2020 |
| Centos_linux | — | Upgrade freeradius-krb5-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-restUpgrade freeradius-mysqlUpgrade freeradius-mysql-debuginfoUpgrade freeradius-perlUpgrade freeradius-debugsourceUpgrade freeradius-docUpgrade freeradius-krb5Upgrade python3-freeradiusUpgrade freeradius-sqliteUpgrade python3-freeradius-debuginfoUpgrade freeradiusUpgrade freeradius-develUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradius-unixODBCUpgrade freeradius-utils-debuginfoUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-pythonUpgrade freeradius-postgresqlUpgrade freeradius-debuginfoUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-unixODBC-debuginfo | Oct 1, 2020 | Mar 21, 2020 |
| Debian | — | Upgrade freeradius | Jul 30, 2024 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade freeradius | Nov 3, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade freeradius | Sep 28, 2020 | Mar 21, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freeradius | Aug 31, 2020 | Mar 21, 2020 |
| Oracle_linux | — | Upgrade freeradius-restUpgrade freeradius-unixODBCUpgrade freeradius-develUpgrade freeradius-docUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradius-pythonUpgrade freeradius-sqliteUpgrade python3-freeradiusUpgrade freeradius-postgresqlUpgrade freeradius-mysqlUpgrade freeradius-krb5Upgrade freeradiusUpgrade freeradius-perl | Oct 7, 2020 | Nov 14, 2019 |
| Redhat_linux | — | Upgrade freeradius-postgresqlUpgrade freeradius-pythonUpgrade freeradius-perl-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-restUpgrade freeradius-debugsourceUpgrade freeradius-utilsUpgrade freeradius-sqlite-debuginfoUpgrade python3-freeradiusUpgrade freeradiusUpgrade freeradius-ldapUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-mysql-debuginfoUpgrade freeradius-mysqlUpgrade freeradius-ldap-debuginfoUpgrade freeradius-unixODBC-debuginfoUpgrade freeradius-perlUpgrade freeradius-utils-debuginfoUpgrade freeradius-krb5Upgrade freeradius-docUpgrade freeradius-rest-debuginfoUpgrade freeradius-develUpgrade python3-freeradius-debuginfoUpgrade freeradius-krb5-debuginfoUpgrade freeradius-debuginfo | Oct 1, 2020 | Mar 21, 2020 |
| Rocky_linux | rocky-upgrade-freeradiusrocky-upgrade-freeradius-debuginforocky-upgrade-freeradius-debugsourcerocky-upgrade-freeradius-develrocky-upgrade-freeradius-docrocky-upgrade-freeradius-krb5rocky-upgrade-freeradius-krb5-debuginforocky-upgrade-freeradius-ldaprocky-upgrade-freeradius-ldap-debuginforocky-upgrade-freeradius-mysqlrocky-upgrade-freeradius-mysql-debuginforocky-upgrade-freeradius-perlrocky-upgrade-freeradius-perl-debuginforocky-upgrade-freeradius-postgresqlrocky-upgrade-freeradius-postgresql-debuginforocky-upgrade-freeradius-restrocky-upgrade-freeradius-rest-debuginforocky-upgrade-freeradius-sqliterocky-upgrade-freeradius-sqlite-debuginforocky-upgrade-freeradius-unixodbcrocky-upgrade-freeradius-unixodbc-debuginforocky-upgrade-freeradius-utilsrocky-upgrade-freeradius-utils-debuginforocky-upgrade-python3-freeradiusrocky-upgrade-python3-freeradius-debuginfo | Mar 12, 2024 | Mar 21, 2020 | |
| Suse | — | suse-upgrade-freeradius-serversuse-upgrade-freeradius-server-develsuse-upgrade-freeradius-server-docsuse-upgrade-freeradius-server-krb5suse-upgrade-freeradius-server-ldapsuse-upgrade-freeradius-server-libssuse-upgrade-freeradius-server-mysqlsuse-upgrade-freeradius-server-perlsuse-upgrade-freeradius-server-postgresqlsuse-upgrade-freeradius-server-pythonsuse-upgrade-freeradius-server-python3suse-upgrade-freeradius-server-sqlitesuse-upgrade-freeradius-server-utils | Apr 18, 2020 | Mar 21, 2020 |
| Ubuntu | ubuntu-pro-upgrade-freeradiusubuntu-upgrade-freeradius | Jan 4, 2023 | Mar 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub