rpm package
opensuse/freeradius-server&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/freeradius-server&distro=openSUSE%20Tumbleweed
Vulnerabilities (18)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-41861 | — | < 3.2.3-2.1 | 3.2.3-2.1 | Jan 17, 2023 | A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. | ||
| CVE-2022-41860 | — | < 3.2.3-2.1 | 3.2.3-2.1 | Jan 17, 2023 | In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the serv | ||
| CVE-2022-41859 | — | < 3.2.3-2.1 | 3.2.3-2.1 | Jan 17, 2023 | In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack. | ||
| CVE-2019-17185 | — | < 3.0.23-1.5 | 3.0.23-1.5 | Mar 21, 2020 | In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by | ||
| CVE-2019-13456 | — | < 3.0.23-1.5 | 3.0.23-1.5 | Dec 3, 2019 | In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This infor | ||
| CVE-2019-11234 | — | < 3.0.23-1.5 | 3.0.23-1.5 | Apr 21, 2019 | FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. | ||
| CVE-2017-10987 | Hig | 7.5 | < 3.0.23-1.5 | 3.0.23-1.5 | Jul 17, 2017 | An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service. | |
| CVE-2017-10986 | Hig | 7.5 | < 3.0.23-1.5 | 3.0.23-1.5 | Jul 17, 2017 | An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service. | |
| CVE-2017-10985 | Hig | 7.5 | < 3.0.23-1.5 | 3.0.23-1.5 | Jul 17, 2017 | An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service. | |
| CVE-2017-10984 | Cri | 9.8 | < 3.0.23-1.5 | 3.0.23-1.5 | Jul 17, 2017 | An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code. | |
| CVE-2017-10983 | Hig | 7.5 | < 3.0.23-1.5 | 3.0.23-1.5 | Jul 17, 2017 | An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service. | |
| CVE-2017-10978 | Hig | 7.5 | < 3.0.23-1.5 | 3.0.23-1.5 | Jul 17, 2017 | An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service. | |
| CVE-2017-9148 | Cri | 9.8 | < 3.0.23-1.5 | 3.0.23-1.5 | May 29, 2017 | The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass au | |
| CVE-2015-4680 | Hig | 7.5 | < 3.0.23-1.5 | 3.0.23-1.5 | Apr 5, 2017 | FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates. | |
| CVE-2015-8763 | Hig | 8.1 | < 3.0.23-1.5 | 3.0.23-1.5 | Mar 27, 2017 | The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read. | |
| CVE-2014-2015 | — | < 3.0.12-1.1 | 3.0.12-1.1 | Nov 2, 2014 | Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code | ||
| CVE-2012-3547 | — | < 3.0.12-1.1 | 3.0.12-1.1 | Sep 18, 2012 | Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client cer | ||
| CVE-2008-4474 | — | < 3.0.23-1.5 | 3.0.23-1.5 | Oct 7, 2008 | freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct. |
- CVE-2022-41861Jan 17, 2023affected < 3.2.3-2.1fixed 3.2.3-2.1
A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.
- CVE-2022-41860Jan 17, 2023affected < 3.2.3-2.1fixed 3.2.3-2.1
In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the serv
- CVE-2022-41859Jan 17, 2023affected < 3.2.3-2.1fixed 3.2.3-2.1
In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
- CVE-2019-17185Mar 21, 2020affected < 3.0.23-1.5fixed 3.0.23-1.5
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by
- CVE-2019-13456Dec 3, 2019affected < 3.0.23-1.5fixed 3.0.23-1.5
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This infor
- CVE-2019-11234Apr 21, 2019affected < 3.0.23-1.5fixed 3.0.23-1.5
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- affected < 3.0.23-1.5fixed 3.0.23-1.5
An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service.
- affected < 3.0.23-1.5fixed 3.0.23-1.5
An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service.
- affected < 3.0.23-1.5fixed 3.0.23-1.5
An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service.
- affected < 3.0.23-1.5fixed 3.0.23-1.5
An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
- affected < 3.0.23-1.5fixed 3.0.23-1.5
An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service.
- affected < 3.0.23-1.5fixed 3.0.23-1.5
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.
- affected < 3.0.23-1.5fixed 3.0.23-1.5
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass au
- affected < 3.0.23-1.5fixed 3.0.23-1.5
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
- affected < 3.0.23-1.5fixed 3.0.23-1.5
The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.
- CVE-2014-2015Nov 2, 2014affected < 3.0.12-1.1fixed 3.0.12-1.1
Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code
- CVE-2012-3547Sep 18, 2012affected < 3.0.12-1.1fixed 3.0.12-1.1
Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client cer
- CVE-2008-4474Oct 7, 2008affected < 3.0.23-1.5fixed 3.0.23-1.5
freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct.