rpm package
suse/freeradius-server&distro=SUSE Linux Enterprise Module for Server Applications 15 SP1
pkg:rpm/suse/freeradius-server&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-17185 | — | < 3.0.16-3.6.1 | 3.0.16-3.6.1 | Mar 21, 2020 | In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by | ||
| CVE-2019-13456 | — | < 3.0.16-3.6.1 | 3.0.16-3.6.1 | Dec 3, 2019 | In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This infor |
- CVE-2019-17185Mar 21, 2020affected < 3.0.16-3.6.1fixed 3.0.16-3.6.1
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by
- CVE-2019-13456Dec 3, 2019affected < 3.0.16-3.6.1fixed 3.0.16-3.6.1
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This infor