In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-freeradiusUpgrade freeradius-krb5Upgrade freeradius-unixODBCUpgrade freeradius-develUpgrade freeradius-mysqlUpgrade freeradius-restUpgrade freeradius-docUpgrade freeradius-sqliteUpgrade freeradius-perlUpgrade freeradius-postgresqlUpgrade freeradiusUpgrade freeradius-ldapUpgrade freeradius-utils | May 15, 2023 | Jan 17, 2023 |
| Alpine Linux | — | Upgrade freeradius | Mar 26, 2024 | Jan 17, 2023 |
| Amazon Linux Ami 2 | — | Upgrade freeradius-develUpgrade freeradius-docUpgrade freeradius-krb5Upgrade freeradius-unixODBCUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradius-debuginfoUpgrade freeradiusUpgrade freeradius-mysqlUpgrade freeradius-pythonUpgrade freeradius-perlUpgrade freeradius-sqliteUpgrade freeradius-postgresql | Mar 7, 2023 | Jan 17, 2023 |
| Centos_linux | — | Upgrade freeradius-unixODBC-debuginfoUpgrade freeradiusUpgrade python3-freeradiusUpgrade freeradius-mysql-debuginfoUpgrade freeradius-ldap-debuginfoUpgrade freeradius-krb5Upgrade freeradius-mysqlUpgrade freeradius-utils-debuginfoUpgrade freeradius-rest-debuginfoUpgrade freeradius-docUpgrade freeradius-debugsourceUpgrade freeradius-restUpgrade freeradius-perlUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-postgresql-debuginfoUpgrade freeradius-unixODBCUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradius-debuginfoUpgrade freeradius-postgresqlUpgrade freeradius-krb5-debuginfoUpgrade python3-freeradius-debuginfoUpgrade freeradius-perl-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-devel | May 15, 2023 | Jan 17, 2023 |
| Debian | — | Upgrade freeradius | Feb 27, 2023 | Jan 17, 2023 |
| Oracle_linux | — | Upgrade freeradius-mysqlUpgrade freeradius-krb5Upgrade python3-freeradiusUpgrade freeradiusUpgrade freeradius-restUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradius-unixODBCUpgrade freeradius-sqliteUpgrade freeradius-docUpgrade freeradius-develUpgrade freeradius-perlUpgrade freeradius-postgresql | May 17, 2023 | Apr 22, 2022 |
| Redhat_linux | — | Upgrade freeradius-perl-debuginfoUpgrade python3-freeradiusUpgrade freeradius-perlUpgrade freeradius-debugsourceNo solution existsUpgrade freeradius-krb5Upgrade freeradius-unixODBC-debuginfoUpgrade python3-freeradius-debuginfoUpgrade freeradius-docUpgrade freeradius-krb5-debuginfoUpgrade freeradius-sqlite-debuginfoUpgrade freeradius-utils-debuginfoUpgrade freeradius-postgresqlUpgrade freeradiusUpgrade freeradius-ldap-debuginfoUpgrade freeradius-ldapUpgrade freeradius-restUpgrade freeradius-rest-debuginfoUpgrade freeradius-sqliteUpgrade freeradius-develUpgrade freeradius-mysql-debuginfoUpgrade freeradius-debuginfoUpgrade freeradius-utilsUpgrade freeradius-unixODBCUpgrade freeradius-mysqlUpgrade freeradius-postgresql-debuginfo | May 15, 2023 | Jan 17, 2023 |
| Rocky_linux | — | Upgrade freeradius-unixODBCUpgrade freeradius-ldapUpgrade freeradius-utilsUpgrade freeradius-develUpgrade freeradius-mysqlUpgrade freeradius-postgresqlUpgrade freeradius-docUpgrade freeradiusUpgrade freeradius-sqliteUpgrade freeradius-perlUpgrade freeradius-restUpgrade freeradius-krb5Upgrade python3-freeradius | Jun 29, 2026 | Jun 26, 2026 |
| Suse | — | Upgrade freeradius-server-python3Upgrade freeradius-server-sqliteUpgrade freeradius-server-ldapUpgrade freeradius-server-krb5Upgrade freeradius-server-utilsUpgrade freeradius-server-libsUpgrade freeradius-server-postgresqlUpgrade freeradius-server-docUpgrade freeradius-server-perlUpgrade freeradius-serverUpgrade freeradius-server-ldap-schemasUpgrade freeradius-server-pythonUpgrade freeradius-server-mysqlUpgrade freeradius-server-devel | Dec 28, 2022 | Dec 27, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub