CVE-2019-11235

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
Configurations

Configuration 1 (hide)

cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-04-22 11:29

Updated : 2023-12-10 12:59


NVD link : CVE-2019-11235

Mitre link : CVE-2019-11235

CVE.ORG link : CVE-2019-11235


JSON object : View

Products Affected

redhat

  • enterprise_linux_server_tus
  • enterprise_linux_server
  • enterprise_linux_workstation
  • enterprise_linux_server_aus
  • enterprise_linux
  • enterprise_linux_eus

freeradius

  • freeradius

opensuse

  • leap

canonical

  • ubuntu_linux

fedoraproject

  • fedora
CWE
CWE-345

Insufficient Verification of Data Authenticity