rpm package
opensuse/freeradius-server&distro=openSUSE Leap 15.1
pkg:rpm/opensuse/freeradius-server&distro=openSUSE%20Leap%2015.1
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-17185 | — | < 3.0.16-lp151.4.4.1 | 3.0.16-lp151.4.4.1 | Mar 21, 2020 | In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by | ||
| CVE-2019-13456 | — | < 3.0.16-lp151.4.4.1 | 3.0.16-lp151.4.4.1 | Dec 3, 2019 | In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This infor | ||
| CVE-2019-11235 | — | < 3.0.16-lp151.4.3.1 | 3.0.16-lp151.4.3.1 | Apr 21, 2019 | FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2 | ||
| CVE-2019-11234 | — | < 3.0.16-lp151.4.3.1 | 3.0.16-lp151.4.3.1 | Apr 21, 2019 | FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. |
- CVE-2019-17185Mar 21, 2020affected < 3.0.16-lp151.4.4.1fixed 3.0.16-lp151.4.4.1
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by
- CVE-2019-13456Dec 3, 2019affected < 3.0.16-lp151.4.4.1fixed 3.0.16-lp151.4.4.1
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This infor
- CVE-2019-11235Apr 21, 2019affected < 3.0.16-lp151.4.3.1fixed 3.0.16-lp151.4.3.1
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2
- CVE-2019-11234Apr 21, 2019affected < 3.0.16-lp151.4.3.1fixed 3.0.16-lp151.4.3.1
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.