{"id":"CVE-2019-17185","aliases":["DEBIAN-CVE-2019-17185","EUVD-2019-7617","GHSA-h63v-34h7-7q42","MGASA-2020-0007","OESA-2021-1031","RHSA-2020:3984","RHSA-2020:4799","RLSA-2020:4799","SUSE-SU-2020:1018-1","SUSE-SU-2020:1020-1","SUSE-SU-2020:1023-1","SUSE-SU-2020:2391-1","UBUNTU-CVE-2019-17185","USN-5785-1","openSUSE-SU-2020:0553-1","openSUSE-SU-2024:10767-1"],"status":"published","title":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to...","description":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02222,"percentile":0.82836,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-662"],"published":"2020-01-05T15:37:51Z","modified":"2026-10-20T10:50:48Z","fixes":[{"ecosystem":"Debian:12","package":"freeradius","fixed_in":["3.0.20+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freeradius","fixed_in":["3.0.20+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freeradius","fixed_in":["3.0.20+dfsg-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-debugsource","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-devel","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-doc","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-krb5","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-krb5-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-ldap","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-ldap-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-mysql","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-mysql-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-perl","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-perl-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-postgresql","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-postgresql-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-rest","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-rest-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-sqlite","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-sqlite-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-unixODBC","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-unixODBC-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-utils","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-utils-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-freeradius","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-freeradius-debuginfo","fixed_in":["0:3.0.20-3.module+el8.3.0+7597+67902674"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"freeradius","fixed_in":["0:3.0.20-3.module+el8.4.0+576+2d493411"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"freeradius","fixed_in":["3.0.16+dfsg-1ubuntu3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-22.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-22.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.13-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-krb5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-rest-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-unixODBC-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.3.0+7597+67902674"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-3.module+el8.4.0+576+2d493411"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.15.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.15.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.15.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.15.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16+dfsg-1ubuntu3.2"}]}],"versions":["3.0.15+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu3","3.0.16+dfsg-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8+dfsg-0.1ubuntu0.1+esm1"}]}],"versions":["2.1.12+dfsg-1.3ubuntu5","2.2.8+dfsg-0.1","2.2.8+dfsg-0.1build1","2.2.8+dfsg-0.1build2","2.2.8+dfsg-0.1ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16+dfsg-1ubuntu3.2"}]}],"versions":["3.0.15+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu3","3.0.16+dfsg-1ubuntu3.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20+dfsg-3ubuntu0.2"}]}],"versions":["3.0.19+dfsg-3","3.0.19+dfsg-3build1","3.0.20+dfsg-1","3.0.20+dfsg-3","3.0.20+dfsg-3build1","3.0.20+dfsg-3ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.1"}]}],"versions":["3.0.21+dfsg-2.2","3.0.21+dfsg-3","3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu2","3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-lp151.4.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.23-1.5"}]}],"bundled":14}],"products":[{"vendor":"freeradius","product":"freeradius"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://freeradius.org/security/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_20","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17185","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h63v-34h7-7q42"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17185","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0007.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25907","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TKODLHHUOVAYENTBP4D3N25ST3Q6LJBP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/USTITI4A3TVUX3SGO7TJCJ4WWFBZFWLZ/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1031","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13456","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3984","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1592741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1630684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1705340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1737663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816680","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3984.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10143","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-13456","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13456","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17185","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4799","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1859527","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4799.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4799","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201018-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1144524","tags":["report"]},{"url":"https://bugzilla.suse.com/1146848","tags":["report"]},{"url":"https://bugzilla.suse.com/1166847","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17185","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201020-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201023-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202391-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-17185","tags":["report"]},{"url":"https://github.com/FreeRADIUS/freeradius-server/commit/6b522f8780813726799e6b8cf0f1f8e0ce2c8ebf","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5785-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-41860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41861","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TMVXSP5XFJILXXXL4PCJEJOUEIQCWQ5X/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11234","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-17185","description":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.","status":"published","published":"2020-03-21T00:13:05Z","modified":"2024-08-05T01:33:17.262Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7617","description":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.","status":"published","published":"2020-03-21T00:13:05Z","modified":"2024-08-05T01:33:17Z","updated_at":"2026-11-03T02:40:30.885546Z"}],"ghsa":[{"id":"GHSA-h63v-34h7-7q42","title":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to...","description":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.","status":"published","published":"2022-05-24T17:12:07Z","modified":"2023-01-29T05:02:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-662"],"updated_at":"2026-11-02T14:45:00.10333Z"}],"nvd":[{"id":"CVE-2019-17185","description":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.","status":"published","published":"2020-03-21T01:15:12.243Z","modified":"2026-06-17T02:23:25.993Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-662"],"updated_at":"2026-11-02T14:05:45.254119Z"}],"osv":[{"id":"CVE-2019-17185","description":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.","status":"published","published":"2020-03-21T01:15:12.243Z","modified":"2026-10-20T10:50:48.410241825Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17185","description":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.","status":"published","published":"2020-03-21T01:15:12.243Z","modified":"2026-09-21T07:03:06.655268584Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"OESA-2021-1031","title":"freeradius security update","description":"Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.\\r\\n\\r\\n\r\nSecurity Fix(es):\\r\\n\\r\\n\r\nIn FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the \"Dragonblood\" attack and CVE-2019-9494.(CVE-2019-13456)\\r\\n\\r\\n\nIn FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.(CVE-2019-17185)\\r\\n\\r\\n","status":"published","published":"2021-02-05T11:04:15Z","modified":"2026-08-18T01:15:04.636671813Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2020:3984","title":"Red Hat Security Advisory: freeradius security and bug fix update","status":"published","published":"2024-09-16T04:01:11Z","modified":"2026-06-26T10:50:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4799","title":"Red Hat Security Advisory: freeradius:3.0 security and bug fix update","status":"published","published":"2024-09-16T04:01:19Z","modified":"2025-11-22T12:11:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4799","title":"Moderate: freeradius:3.0 security and bug fix update","description":"FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.\n\nSecurity Fix(es):\n\n* freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access (CVE-2019-17185)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:37:04Z","modified":"2026-02-04T21:45:07.584904Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-17185","description":"In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.","status":"published","published":"2020-03-21T01:15:00Z","modified":"2026-04-22T12:13:32.427714Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"MGASA-2020-0007","title":"Updated freeradius packages fix security vulnerabilities","description":"Updated freeradius packages fix security vulnerabilities:\n\nIt was discovered freeradius does not correctly configure logrotate,\nallowing a local attacker who already has control of the radiusd user to\nescalate his privileges to root, by tricking logrotate into writing a\nradiusd-writable file to a directory normally inaccessible by the radiusd\n user (CVE-2019-10143).\n\nAn information leak was discovered in the implementation of EAP-pwd in\nfreeradius. An attacker could initiate several EAP-pwd handshakes to leak\ninformation, which can then be used to recover the user's WiFi password by\nperforming dictionary and brute-force attacks (CVE-2019-13456).\n\nDenial of service issues due to multithreaded BN_CTX access\n(CVE-2019-17185).\n","status":"published","published":"2020-01-05T15:37:51Z","modified":"2026-04-16T04:42:47.251510972Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0553-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd\n  (bsc#1144524).\n- CVE-2019-17185: Fixed a debial of service due to multithreaded\n  BN_CTX access (bsc#1166847).\n- Fixed an issue in TLS-EAP where the OCSP verification, when an \n  intermediate client certificate was not explicitly trusted \n  (bsc#1146848).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-04-26T12:11:06Z","modified":"2026-02-04T02:37:51.021129Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10767-1","title":"freeradius-server-3.0.23-1.5 on GA media","description":"These are all security issues fixed in the freeradius-server-3.0.23-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:14:45.599468Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:1018-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd\n  (bsc#1144524).\n- CVE-2019-17185: Fixed a debial of service due to multithreaded\n  BN_CTX access (bsc#1166847).\n- Fixed an issue in TLS-EAP where the OCSP verification, when an \n  intermediate client certificate was not explicitly trusted \n  (bsc#1146848).\n","status":"published","published":"2020-04-17T06:39:32Z","modified":"2026-02-04T02:38:03.359928Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1020-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd\n  (bsc#1144524).\n- CVE-2019-17185: Fixed a debial of service due to multithreaded\n  BN_CTX access (bsc#1166847).\n ","status":"published","published":"2020-04-17T08:32:25Z","modified":"2026-02-04T02:35:39.832314Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1023-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd\n  (bsc#1144524).\n- CVE-2019-17185: Fixed a debial of service due to multithreaded\n  BN_CTX access (bsc#1166847).\n- Fixed an issue in TLS-EAP where the OCSP verification, when an \n  intermediate client certificate was not explicitly trusted \n  (bsc#1146848).\n","status":"published","published":"2020-04-17T10:02:07Z","modified":"2026-02-04T04:02:24.125292Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2391-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd\n  (bsc#1144524).\n- CVE-2019-17185: Fixed a debial of service due to multithreaded\n  BN_CTX access (bsc#1166847).\n","status":"published","published":"2020-08-31T11:30:52Z","modified":"2025-05-02T04:08:47.973643Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-5785-1","title":"freeradius vulnerabilities","description":"It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd\nhandshakes. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17185)\n\nShane Guan discovered that FreeRADIUS incorrectly handled memory when\nchecking unknown SIM option sent by EAP-SIM supplicant. An attacker could\npossibly use this issue to cause a denial of service on the server. This\nissue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04\nLTS. (CVE-2022-41860)\n\nIt was discovered that FreeRADIUS incorrectly handled memory when\nprocessing certain abinary attributes. An attacker could possibly use this\nissue to cause a denial of service on the server. (CVE-2022-41861)\n","status":"published","published":"2023-01-04T10:53:54Z","modified":"2026-06-25T13:31:39.352568124Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}