CVE-2019-11234
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a ...
9.8 CriticalFix available
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
7.62%Up 5.1 points since Apr 14, 2021
What each source reports
NVD Score used
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- Record
CVE-2019-11234- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- Record
CVE-2019-11234- Updated
- 2026-11-02
EUVDEUVD-2019-2933 No score
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- Record
EUVD-2019-2933- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vwq6-jpj7-xqvx
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a ...
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- Record
GHSA-vwq6-jpj7-xqvx- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-11234
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- Record
ALPINE-CVE-2019-11234- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- Record
CVE-2019-11234- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2019-11234
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- Record
DEBIAN-CVE-2019-11234- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:1131
Red Hat Security Advisory: freeradius security update
- Record
RHSA-2019:1131- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2019:1142
Red Hat Security Advisory: freeradius:3.0 security update
- Record
RHSA-2019:1142- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-11234
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
- Record
UBUNTU-CVE-2019-11234- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0176 No score
Updated freeradius packages fix security vulnerability
An attacker can reflect the received scalar and element from the server in it's own commit message, and subsequently reflect the confirm value as well. This causes the adversary to successfully authenticate as the victim (CVE-2019-11234).
An invalid curve attack allows an attacker to authenticate as any user (without knowing the password). The problem is that on the reception of an EAP-PWD Commit frame, FreeRADIUS doesn't verify whether the received elliptic curve point is valid (CVE-2019-11235).
- Record
MGASA-2019-0176- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1346-1 No score
Security update for freeradius-server
This update for freeradius-server fixes the following issues:
Security issues fixed:
- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1346-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0542-1 No score
Security update for freeradius-server
This update for freeradius-server fixes the following issues:
Security issues fixed:
- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0542-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10767-1 No score
freeradius-server-3.0.23-1.5 on GA media
These are all security issues fixed in the freeradius-server-3.0.23-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10767-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1039-1 No score
Security update for freeradius-server
This update for freeradius-server fixes the following issues:
Security issues fixed:
- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).
- Record
SUSE-SU-2019:1039-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1086-1 No score
Security update for freeradius-server
This update for freeradius-server fixes the following issues:
Security issues fixed:
- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).
- Record
SUSE-SU-2019:1086-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1181-1 No score
Security update for freeradius-server
This update for freeradius-server fixes the following issues:
Security issues fixed:
- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).
- Record
SUSE-SU-2019:1181-1- Updated
- 2026-11-02
OSVUSN-3954-1 No score
freeradius vulnerabilities
It was discovered that FreeRADIUS incorrectly handled certain inputs. An attacker could possibly use this issue to bypass authentication. (CVE-2019-11234, CVE-2019-11235)
- Record
USN-3954-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freeradiusAlpine:v3.10 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.11 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.12 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.13 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.14 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.15 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.16 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.17 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.18 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.19 |
before 3.0.19-r0 | 3.0.19-r0 |
Show 81 moreShow less
| Package | Affected | Fixed |
|---|---|---|
freeradiusAlpine:v3.20 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.21 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.22 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.23 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.24 |
before 3.0.19-r0 | 3.0.19-r0 |
freeradiusAlpine:v3.6 |
before 3.0.13-r3 | 3.0.13-r3 |
freeradiusAlpine:v3.7 |
before 3.0.15-r4 | 3.0.15-r4 |
freeradiusAlpine:v3.8 |
before 3.0.17-r3 | 3.0.17-r3 |
freeradiusAlpine:v3.9 |
before 3.0.17-r5 | 3.0.17-r5 |
freeradiusDebian:12 |
before 3.0.17+dfsg-1.1 | 3.0.17+dfsg-1.1 |
freeradiusDebian:13 |
before 3.0.17+dfsg-1.1 | 3.0.17+dfsg-1.1 |
freeradiusDebian:14 |
before 3.0.17+dfsg-1.1 | 3.0.17+dfsg-1.1 |
freeradiusMageia:6 |
before 3.0.15-1.1.mga6 | 3.0.15-1.1.mga6 |
freeradiusRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-debuginfoRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-develRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-docRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-krb5Red Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-ldapRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-mysqlRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-perlRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-postgresqlRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-pythonRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-sqliteRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-unixODBCRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-utilsRed Hat:enterprise_linux:7::server |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradiusRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-develRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-docRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-krb5Red Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-ldapRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-mysqlRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-perlRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-postgresqlRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-pythonRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-sqliteRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-unixODBCRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradius-utilsRed Hat:enterprise_linux:7::workstation |
before 0:3.0.13-10.el7_6 | 0:3.0.13-10.el7_6 |
freeradiusRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-develRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-docRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-krb5Red Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-krb5-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-ldapRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-ldap-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-mysqlRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-mysql-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-perlRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-perl-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-postgresqlRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-postgresql-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-restRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-rest-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-sqliteRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-sqlite-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-unixODBCRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-unixODBC-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-utilsRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-utils-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.0.17-4.module+el8.0.0+3108+851cb559 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 |
freeradius-serverSUSE:OpenStack Cloud 7 |
before 3.0.3-17.12.1 | 3.0.3-17.12.1 |
freeradius-serverSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 3.0.3-17.12.1 | 3.0.3-17.12.1 |
freeradius-serverSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 3.0.3-17.12.1 | 3.0.3-17.12.1 |
freeradius-serverSUSE:Linux Enterprise Server 12-LTSS |
before 3.0.3-17.12.1 | 3.0.3-17.12.1 |
freeradius-serverSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 3.0.3-17.12.1 | 3.0.3-17.12.1 |
freeradius-serverSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 3.0.3-17.12.1 | 3.0.3-17.12.1 |
freeradius-serverSUSE:Linux Enterprise Server 12 SP2-BCL |
before 3.0.3-17.12.1 | 3.0.3-17.12.1 |
freeradius-serverSUSE:Enterprise Storage 4 |
before 3.0.3-17.12.1 | 3.0.3-17.12.1 |
freeradius-serverSUSE:Linux Enterprise Module for Server Applications 15 |
before 3.0.16-3.3.1 | 3.0.16-3.3.1 |
freeradius-serverSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 3.0.15-2.11.2 | 3.0.15-2.11.2 |
freeradius-serverSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 3.0.15-2.11.2 | 3.0.15-2.11.2 |
freeradius-serverSUSE:Linux Enterprise Server 12 SP3 |
before 3.0.15-2.11.2 | 3.0.15-2.11.2 |
freeradius-serverSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 3.0.15-2.11.2 | 3.0.15-2.11.2 |
freeradius-serverSUSE:Linux Enterprise Server 12 SP4 |
before 3.0.15-2.11.2 | 3.0.15-2.11.2 |
freeradius-serverSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 3.0.15-2.11.2 | 3.0.15-2.11.2 |
freeradiusUbuntu:18.04:LTS |
before 3.0.16+dfsg-1ubuntu3.1, plus listed versions 3.0.15+dfsg-1ubuntu23.0.16+dfsg-1ubuntu23.0.16+dfsg-1ubuntu3 |
3.0.16+dfsg-1ubuntu3.1 |
freeradius-serveropenSUSE:Leap 15.0 |
before 3.0.16-lp150.2.3.1 | 3.0.16-lp150.2.3.1 |
freeradius-serveropenSUSE:Leap 15.1 |
before 3.0.16-lp151.4.3.1 | 3.0.16-lp151.4.3.1 |
freeradius-serveropenSUSE:Tumbleweed |
before 3.0.23-1.5 | 3.0.23-1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11234 is a critical vulnerability (CVSS 9.8) in Freeradius, published April 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.62%, the 94th percentile. Fixed in freeradius 3.0.19-r0.
References
freeradius.org/release_notes?br=3.0.x&re=3.0.19
papers.mathyvanhoef.com/dragonblood.pdf
kb.cert.org/vuls/id/871675
bugzilla.redhat.com/show_bug.cgi?id=1695783
usn.ubuntu.com/3954-1
Show 47 moreShow less
lists.opensuse.org/opensuse-security-announce/2019-05/msg00014.html
access.redhat.com/errata/RHSA-2019:1131
nvd.nist.gov/vuln/detail/CVE-2019-11234
github.com/advisories/GHSA-vwq6-jpj7-xqvx
security.alpinelinux.org/vuln/CVE-2019-11234
security-tracker.debian.org/tracker/CVE-2019-11234
advisories.mageia.org/MGASA-2019-0176.html
bugs.mageia.org/show_bug.cgi?id=24762
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1131.json
cve.org/CVERecord?id=CVE-2019-11234
suse.com/support/update/announcement/2019/suse-su-20191039-1
bugzilla.suse.com/1132549
ubuntu.com/security/CVE-2019-11234