Name: CVE-2022-41859: Exposure of Sensitive Information to an Unauthorized Actor
Creator: Rapid7
Published: 2023-01-17T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2022-41859, CWE-200, CWE-522, CVSS 7.5, EPSS 0.00867

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade freeradius-perlUpgrade freeradius-sqliteUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradiusUpgrade freeradius-docUpgrade freeradius-postgresqlUpgrade freeradius-mysqlUpgrade freeradius-unixODBCUpgrade python3-freeradiusUpgrade freeradius-krb5Upgrade freeradius-restUpgrade freeradius-devel	May 15, 2023	Jan 17, 2023
Alpine Linux	—	Upgrade freeradius	Mar 26, 2024	Jan 17, 2023
Amazon Linux Ami 2	—	Upgrade freeradius-mysqlUpgrade freeradiusUpgrade freeradius-sqliteUpgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade freeradius-pythonUpgrade freeradius-krb5Upgrade freeradius-develUpgrade freeradius-ldapUpgrade freeradius-unixODBCUpgrade freeradius-utilsUpgrade freeradius-docUpgrade freeradius-debuginfo	Mar 7, 2023	Jan 17, 2023
Centos_linux	—	Upgrade freeradius-ldap-debuginfoUpgrade freeradius-perlUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-utils-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-docUpgrade freeradius-krb5Upgrade freeradius-unixODBC-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-restUpgrade freeradius-debugsourceUpgrade freeradiusUpgrade freeradius-mysqlUpgrade python3-freeradiusUpgrade python3-freeradius-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-utilsUpgrade freeradius-sqliteUpgrade freeradius-krb5-debuginfoUpgrade freeradius-develUpgrade freeradius-postgresqlUpgrade freeradius-ldapUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-perl-debuginfo	May 15, 2023	Jan 17, 2023
Debian	—	Upgrade freeradius	Feb 27, 2023	Jan 17, 2023
Oracle_linux	—	Upgrade freeradius-mysqlUpgrade freeradius-krb5Upgrade freeradius-utilsUpgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade freeradiusUpgrade freeradius-ldapUpgrade freeradius-restUpgrade python3-freeradiusUpgrade freeradius-unixODBCUpgrade freeradius-docUpgrade freeradius-sqliteUpgrade freeradius-devel	May 17, 2023	Apr 22, 2022
Redhat_linux	—	Upgrade freeradius-unixODBC-debuginfoUpgrade freeradius-perlNo solution existsUpgrade freeradius-ldap-debuginfoUpgrade freeradius-ldapUpgrade freeradius-restUpgrade freeradius-utils-debuginfoUpgrade freeradius-krb5Upgrade freeradius-postgresqlUpgrade freeradiusUpgrade freeradius-docUpgrade freeradius-perl-debuginfoUpgrade freeradius-debugsourceUpgrade freeradius-sqlite-debuginfoUpgrade python3-freeradiusUpgrade freeradius-krb5-debuginfoUpgrade python3-freeradius-debuginfoUpgrade freeradius-utilsUpgrade freeradius-develUpgrade freeradius-rest-debuginfoUpgrade freeradius-mysql-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-mysqlUpgrade freeradius-debuginfo	May 15, 2023	Jan 17, 2023
Rocky_linux	—	Upgrade freeradius-unixODBCUpgrade freeradius-utilsUpgrade freeradius-mysqlUpgrade freeradius-develUpgrade freeradius-ldapUpgrade freeradius-restUpgrade freeradius-postgresqlUpgrade freeradius-perlUpgrade python3-freeradiusUpgrade freeradius-docUpgrade freeradiusUpgrade freeradius-sqliteUpgrade freeradius-krb5	Jun 29, 2026	Jun 26, 2026
Suse	—	Upgrade freeradius-server-krb5Upgrade freeradius-server-ldapUpgrade freeradius-server-sqliteUpgrade freeradius-server-python3Upgrade freeradius-server-utilsUpgrade freeradius-server-libsUpgrade freeradius-serverUpgrade freeradius-server-postgresqlUpgrade freeradius-server-ldap-schemasUpgrade freeradius-server-pythonUpgrade freeradius-server-docUpgrade freeradius-server-mysqlUpgrade freeradius-server-develUpgrade freeradius-server-perl	Dec 28, 2022	Dec 27, 2022

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence