Vulnerabilities (CVE)

Filtered by vendor Freeradius Subscribe
Filtered by product Freeradius
Total 44 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-17185 2 Freeradius, Opensuse 2 Freeradius, Leap 2022-04-22 5.0 MEDIUM 7.5 HIGH
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
CVE-2019-13456 4 Freeradius, Linux, Opensuse and 1 more 4 Freeradius, Linux Kernel, Leap and 1 more 2022-01-01 2.9 LOW 6.5 MEDIUM
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.
CVE-2019-10143 3 Fedoraproject, Freeradius, Redhat 3 Fedora, Freeradius, Enterprise Linux 2020-09-30 6.9 MEDIUM 7.0 HIGH
** DISPUTED ** It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."
CVE-2017-10985 1 Freeradius 1 Freeradius 2019-10-03 7.8 HIGH 7.5 HIGH
An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service.
CVE-2017-10987 1 Freeradius 1 Freeradius 2019-10-03 5.0 MEDIUM 7.5 HIGH
An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service.
CVE-2017-10980 1 Freeradius 1 Freeradius 2019-10-03 5.0 MEDIUM 7.5 HIGH
An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode_tlv()" and a denial of service.
CVE-2017-10982 1 Freeradius 1 Freeradius 2019-10-03 5.0 MEDIUM 7.5 HIGH
An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.
CVE-2017-10981 1 Freeradius 1 Freeradius 2019-10-03 5.0 MEDIUM 7.5 HIGH
An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr_dhcp_decode()" and a denial of service.
CVE-2017-10986 1 Freeradius 1 Freeradius 2019-10-03 5.0 MEDIUM 7.5 HIGH
An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service.
CVE-2017-10978 3 Debian, Freeradius, Redhat 8 Debian Linux, Freeradius, Enterprise Linux Desktop and 5 more 2019-07-03 5.0 MEDIUM 7.5 HIGH
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.
CVE-2019-11235 5 Canonical, Fedoraproject, Freeradius and 2 more 10 Ubuntu Linux, Fedora, Freeradius and 7 more 2019-05-13 7.5 HIGH 9.8 CRITICAL
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.
CVE-2019-11234 4 Canonical, Fedoraproject, Freeradius and 1 more 4 Ubuntu Linux, Fedora, Freeradius and 1 more 2019-05-13 7.5 HIGH 9.8 CRITICAL
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
CVE-2001-1376 12 Ascend, Freeradius, Gnu and 9 more 12 Radius, Freeradius, Radius and 9 more 2018-10-30 7.5 HIGH N/A
Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.
CVE-2001-1377 11 Freeradius, Gnu, Icradius and 8 more 11 Freeradius, Radius, Icradius and 8 more 2018-10-30 5.0 MEDIUM N/A
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
CVE-2007-0080 1 Freeradius 1 Freeradius 2018-10-16 6.6 MEDIUM N/A
** DISPUTED ** Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance. NOTE: the impact of this issue has been disputed by a reliable third party and the vendor, who states that exploitation is limited "only to local administrators who have write access to the server configuration files." CVE concurs with the dispute.
CVE-2015-4680 2 Freeradius, Suse 3 Freeradius, Linux Enterprise Server, Linux Enterprise Software Development Kit 2018-10-09 5.0 MEDIUM 7.5 HIGH
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
CVE-2011-2701 1 Freeradius 1 Freeradius 2018-10-09 5.8 MEDIUM N/A
The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.
CVE-2017-10984 1 Freeradius 1 Freeradius 2018-01-05 7.5 HIGH 9.8 CRITICAL
An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
CVE-2017-10979 1 Freeradius 1 Freeradius 2018-01-05 7.5 HIGH 9.8 CRITICAL
An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
CVE-2017-9148 1 Freeradius 1 Freeradius 2018-01-05 7.5 HIGH 9.8 CRITICAL
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.