{"id":"CVE-2017-9148","aliases":["DEBIAN-CVE-2017-9148","DLA-977-1","EUVD-2017-18086","GHSA-qvp7-wcjq-6rv5","RHSA-2017:1581","SUSE-SU-2017:1705-1","SUSE-SU-2017:1777-1","UBUNTU-CVE-2017-9148","openSUSE-SU-2024:10767-1"],"status":"published","title":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017...","description":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03914,"percentile":0.90381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2017-05-29T00:00:00Z","modified":"2026-10-24T10:30:41Z","fixes":[{"ecosystem":"Debian:12","package":"freeradius","fixed_in":["3.0.12+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freeradius","fixed_in":["3.0.12+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freeradius","fixed_in":["3.0.12+dfsg-5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-debuginfo","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-devel","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-doc","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-krb5","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-ldap","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-mysql","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-perl","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-postgresql","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-python","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-sqlite","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-unixODBC","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-utils","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-debuginfo","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-devel","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-doc","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-krb5","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-ldap","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-mysql","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-perl","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-postgresql","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-python","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-sqlite","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-unixODBC","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-utils","fixed_in":["0:3.0.4-8.el7_3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"freeradius-server","fixed_in":["3.0.3-17.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"freeradius-server","fixed_in":["3.0.3-17.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"freeradius-server","fixed_in":["3.0.3-17.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"freeradius-server","fixed_in":["3.0.3-17.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12+dfsg-1.2+deb7u1"}]}],"versions":["2.1.12+dfsg-1.2"],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-8.el7_3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-7.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-7.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-7.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.23-1.5"}]}],"bundled":14}],"products":[{"vendor":"freeradius","product":"freeradius"}],"references":[{"url":"http://freeradius.org/security.html","tags":["x_refsource_MISC","x_transferred","Not Applicable","web","report"]},{"url":"http://seclists.org/oss-sec/2017/q2/422","tags":["x_refsource_MISC","x_transferred","Mailing List","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1581","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1038576","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/98734","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201706-27","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9148","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qvp7-wcjq-6rv5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9148","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456697","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1581.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9148","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171705-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027243","tags":["report"]},{"url":"https://bugzilla.suse.com/1041445","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9148","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/912873","tags":["report"]},{"url":"https://bugzilla.suse.com/935573","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4680","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-9148","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/05/29/1","tags":["report"]},{"url":"http://freeradius.org/security.html#session-resumption-2017","tags":["report"]},{"url":"http://seclists.org/oss-sec/2017/q2/342","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3316-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-9148","description":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.","status":"published","published":"2017-05-29T17:00:00Z","modified":"2024-08-05T16:55:22.379Z","updated_at":"2026-11-02T14:33:13.96587Z"}],"euvd":[{"id":"EUVD-2017-18086","description":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.","status":"published","published":"2017-05-29T17:00:00Z","modified":"2024-08-05T16:55:22Z","updated_at":"2026-11-03T02:23:28.642509Z"}],"ghsa":[{"id":"GHSA-qvp7-wcjq-6rv5","title":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017...","description":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.","status":"published","published":"2022-05-14T03:53:45Z","modified":"2023-02-03T05:00:46Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:52:51.467928Z"}],"nvd":[{"id":"CVE-2017-9148","description":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.","status":"published","published":"2017-05-29T17:29:00.2Z","modified":"2026-06-17T01:27:33.987Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:03:49.449157Z"}],"osv":[{"id":"CVE-2017-9148","description":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.","status":"published","published":"2017-05-29T17:29:00.2Z","modified":"2026-10-24T10:30:41.21678167Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-9148","description":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.","status":"published","published":"2017-05-29T17:29:00.2Z","modified":"2026-09-01T20:03:51.427879009Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"RHSA-2017:1581","title":"Red Hat Security Advisory: freeradius security update","status":"published","published":"2024-09-16T00:24:57Z","modified":"2026-06-26T10:34:21Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-9148","description":"The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.","status":"withdrawn","published":"2017-05-29T00:00:00Z","modified":"2026-02-04T02:15:17.646893Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-977-1","title":"freeradius - security update","status":"published","published":"2017-06-05T00:00:00Z","modified":"2026-03-09T02:11:38.404937Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"openSUSE-SU-2024:10767-1","title":"freeradius-server-3.0.23-1.5 on GA media","description":"These are all security issues fixed in the freeradius-server-3.0.23-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:14:45.599468Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2017:1705-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate\n  authentication bypass. (bsc#1041445)\n\nNon security issue fixed:\n\n- Fix case insensitive matching in compiled regular expressions (bsc#1027243)\n  \n","status":"published","published":"2017-06-27T15:19:07Z","modified":"2026-02-04T03:20:26.804229Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1777-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate\n  authentication bypass. (bnc#1041445)\n- CVE-2015-4680: Add a configuration option to allow checking of all\n  intermediate certificates for revocations. (bnc#935573)\n\nThe following non security issue was fixed:\n\n- Cannot create table radpostauth because of deprecated TIMESTAMP(14) syntax. (bsc#912873)\n","status":"published","published":"2017-07-04T13:54:26Z","modified":"2026-02-04T03:26:53.747583Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}