{"id":"CVE-2019-11234","aliases":["ALPINE-CVE-2019-11234","DEBIAN-CVE-2019-11234","EUVD-2019-2933","GHSA-vwq6-jpj7-xqvx","MGASA-2019-0176","RHSA-2019:1131","RHSA-2019:1142","SUSE-SU-2019:1039-1","SUSE-SU-2019:1086-1","SUSE-SU-2019:1181-1","UBUNTU-CVE-2019-11234","USN-3954-1","openSUSE-SU-2019:1346-1","openSUSE-SU-2020:0542-1","openSUSE-SU-2024:10767-1"],"status":"published","title":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a ...","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07624,"percentile":0.94602,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2019-04-16T00:00:00Z","modified":"2026-10-24T14:21:01Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"freeradius","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"freeradius","fixed_in":["3.0.13-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"freeradius","fixed_in":["3.0.15-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"freeradius","fixed_in":["3.0.17-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"freeradius","fixed_in":["3.0.17-r5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"freeradius","fixed_in":["3.0.17+dfsg-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freeradius","fixed_in":["3.0.17+dfsg-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freeradius","fixed_in":["3.0.17+dfsg-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"freeradius","fixed_in":["3.0.16+dfsg-1ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.17-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.17-r5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.17+dfsg-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.17+dfsg-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.17+dfsg-1.1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-1.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-10.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-krb5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-rest-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-unixODBC-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.17-4.module+el8.0.0+3108+851cb559"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.11.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.11.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.11.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.11.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.11.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.11.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16+dfsg-1ubuntu3.1"}]}],"versions":["3.0.15+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16+dfsg-1ubuntu3.1"}]}],"versions":["3.0.15+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-lp150.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-lp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.23-1.5"}]}],"bundled":14}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"freeradius","product":"freeradius"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://freeradius.org/release_notes/?br=3.0.x\u0026re=3.0.19","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://papers.mathyvanhoef.com/dragonblood.pdf","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory"]},{"url":"https://www.kb.cert.org/vuls/id/871675/","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","US Government Resource","advisory"]},{"url":"https://freeradius.org/security/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695783","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://usn.ubuntu.com/3954-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1131","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1142","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00033.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11234","tags":["advisory"]},{"url":"https://freeradius.org/security"},{"url":"https://usn.ubuntu.com/3954-1"},{"url":"https://www.kb.cert.org/vuls/id/871675"},{"url":"https://github.com/advisories/GHSA-vwq6-jpj7-xqvx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-11234","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11234","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0176.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695748","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1131.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11234","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11234","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11235","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11235","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1142.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191039-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1132549","tags":["report"]},{"url":"https://bugzilla.suse.com/1132664","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11235","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191086-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191181-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11234","tags":["report"]},{"url":"https://github.com/FreeRADIUS/freeradius-server/commit/85497b5ff37ccb656895b826b88585898c209586","tags":["report"]},{"url":"https://github.com/FreeRADIUS/freeradius-server/commit/ab4c767099f263a7cd4109bcdca80ee74210a769","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3954-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11235","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N5NJZCFMF2WWTEIRNAML6C6UXN7RD2S5/#N5NJZCFMF2WWTEIRNAML6C6UXN7RD2S5","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KRT7OQMTAGCH47U5CUE43ZVIS7MSQ35Z/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-11234","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","status":"published","published":"2019-04-21T16:36:48Z","modified":"2024-08-04T22:48:08.954Z","updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-2933","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","status":"published","published":"2019-04-21T16:36:48Z","modified":"2024-08-04T22:48:08Z","updated_at":"2026-11-03T02:40:49.794129Z"}],"ghsa":[{"id":"GHSA-vwq6-jpj7-xqvx","title":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a ...","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","status":"published","published":"2022-05-24T16:44:02Z","modified":"2024-04-04T00:02:37Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:55:48.925076Z"}],"nvd":[{"id":"CVE-2019-11234","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","status":"published","published":"2019-04-22T11:29:03.33Z","modified":"2026-06-17T02:12:35.563Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"ALPINE-CVE-2019-11234","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","status":"published","published":"2019-04-22T11:29:03.33Z","modified":"2026-09-21T06:17:52.457278672Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-11234","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","status":"published","published":"2019-04-22T11:29:03.33Z","modified":"2026-10-24T14:21:01.483922396Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-11234","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","status":"published","published":"2019-04-22T11:29:03.33Z","modified":"2026-09-21T07:01:58.999407318Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2019:1131","title":"Red Hat Security Advisory: freeradius security update","status":"published","published":"2024-09-16T02:23:37Z","modified":"2026-06-26T10:41:24Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:1142","title":"Red Hat Security Advisory: freeradius:3.0 security update","status":"published","published":"2024-09-16T02:23:29Z","modified":"2025-11-22T11:41:34Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2019-11234","description":"FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a \"Dragonblood\" issue, a similar issue to CVE-2019-9497.","status":"published","published":"2019-04-16T00:00:00Z","modified":"2026-04-22T12:07:07.502615Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"MGASA-2019-0176","title":"Updated freeradius packages fix security vulnerability","description":"An attacker can reflect the received scalar and element from the server in\nit's own commit message, and subsequently reflect the confirm value as\nwell. This causes the adversary to successfully authenticate as the victim\n(CVE-2019-11234).\n\nAn invalid curve attack allows an attacker to authenticate as any user\n(without knowing the password). The problem is that on the reception of an\nEAP-PWD Commit frame, FreeRADIUS doesn't verify whether the received\nelliptic curve point is valid (CVE-2019-11235).\n","status":"published","published":"2019-05-18T12:33:10Z","modified":"2026-04-16T04:41:10.315251407Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1346-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).\n- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-05-08T07:44:06Z","modified":"2026-02-04T04:17:59.335781Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2020:0542-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).\n- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-04-23T08:10:23Z","modified":"2026-02-04T03:58:13.796363Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10767-1","title":"freeradius-server-3.0.23-1.5 on GA media","description":"These are all security issues fixed in the freeradius-server-3.0.23-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:14:45.599468Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:1039-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).\n- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).\n","status":"published","published":"2019-04-25T12:57:45Z","modified":"2026-02-04T02:25:21.2149Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1086-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).\n- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).\n","status":"published","published":"2019-04-29T09:27:36Z","modified":"2026-02-04T03:25:18.446719Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1181-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).\n- CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).\n","status":"published","published":"2019-05-07T16:10:05Z","modified":"2026-02-04T03:55:18.383452Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3954-1","title":"freeradius vulnerabilities","description":"It was discovered that FreeRADIUS incorrectly handled certain inputs.\nAn attacker could possibly use this issue to bypass authentication.\n(CVE-2019-11234, CVE-2019-11235)\n","status":"published","published":"2019-04-24T12:39:28Z","modified":"2026-04-22T09:55:46.743176Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}