{"id":"CVE-2022-41859","aliases":["ALPINE-CVE-2022-41859","ALSA-2023:2166","ALSA-2023:2870","DEBIAN-CVE-2022-41859","DLA-3342-1","DLA-4232-1","EUVD-2022-45023","GHSA-cmvm-c7qf-pmc5","MGASA-2022-0482","OESA-2023-1953","OESA-2023-1954","OESA-2023-1955","OESA-2023-1956","RHSA-2023:2166","RHSA-2023:2870","RLSA-2023:2870","SUSE-SU-2022:4620-1","SUSE-SU-2022:4621-1","SUSE-SU-2022:4622-1","SUSE-SU-2022:4626-1","SUSE-SU-2023:0124-1","SUSE-SU-2023:0135-1","UBUNTU-CVE-2022-41859","openSUSE-SU-2024:13386-1"],"status":"published","title":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the...","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00891,"percentile":0.59701,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-522"],"published":"2022-12-27T07:04:14Z","modified":"2026-11-03T07:18:33Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"freeradius","fixed_in":["3.0.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"freeradius","fixed_in":["3.0.26-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"freeradius","fixed_in":["3.2.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freeradius","fixed_in":["3.2.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freeradius","fixed_in":["3.2.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"freeradius","fixed_in":["3.0.15-27.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"freeradius","fixed_in":["3.0.15-27.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"freeradius","fixed_in":["3.0.15-27.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"freeradius","fixed_in":["3.0.25-2.oe2203"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-14.module_el8.8.0+3469+c05aea40"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.17+dfsg-1.1+deb10u2"}]}],"versions":["3.0.17+dfsg-1.1","3.0.17+dfsg-1.1+deb10u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21+dfsg-2.2+deb11u2"}]}],"versions":["3.0.21+dfsg-2.2","3.0.21+dfsg-2.2+deb11u1","3.0.21+dfsg-2.2+deb11u1~bpo10+1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.22-1.1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-27.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-27.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-27.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.25-2.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-krb5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freeradius-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-rest-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freeradius-unixODBC-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-37.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-krb5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-rest-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-unixODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-unixODBC-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freeradius-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+17558+3f8a93b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.20-14.module+el8.8.0+1130+46a6e0a1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-150000.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-150200.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.25-150400.4.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.25-150400.4.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-2.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-17.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.15+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu2","3.0.16+dfsg-1ubuntu3","3.0.16+dfsg-1ubuntu3.1","3.0.16+dfsg-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.19+dfsg-3","3.0.19+dfsg-3build1","3.0.20+dfsg-1","3.0.20+dfsg-3","3.0.20+dfsg-3build1","3.0.20+dfsg-3ubuntu0.1","3.0.20+dfsg-3ubuntu0.2","3.0.20+dfsg-3ubuntu0.4","3.0.20+dfsg-3ubuntu0.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freeradius-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.1"}]}],"bundled":3}],"products":[{"vendor":"freeradius","product":"freeradius"}],"references":[{"url":"https://freeradius.org/security/","tags":["x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00030.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41859","tags":["advisory"]},{"url":"https://freeradius.org/security"},{"url":"https://github.com/advisories/GHSA-cmvm-c7qf-pmc5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-41859","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2166","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41859","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41861","tags":["report"]},{"url":"https://bugzilla.redhat.com/2078483","tags":["report"]},{"url":"https://bugzilla.redhat.com/2078485","tags":["report"]},{"url":"https://bugzilla.redhat.com/2078487","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2166.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2870","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-2870.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41859.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-41859","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0482.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31291","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GZM4O5MGLKNOE2SSXAXQNL5DSII556QA/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YGQKLVAIGSOB2CSLQ2ASBK2MJAHL4LCI/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1953","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1954","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1955","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1956","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2078483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2078485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2078487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126380","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2166.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41859","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41860","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41861","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2870.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2870","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224620-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180525","tags":["report"]},{"url":"https://bugzilla.suse.com/1184016","tags":["report"]},{"url":"https://bugzilla.suse.com/1206204","tags":["report"]},{"url":"https://bugzilla.suse.com/1206205","tags":["report"]},{"url":"https://bugzilla.suse.com/1206206","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41861","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224621-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224622-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224626-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230124-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230135-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-41859","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-41859","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","status":"published","published":"2023-01-17T00:00:00Z","modified":"2025-11-03T19:27:37.502Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-45023","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","status":"published","published":"2023-01-17T00:00:00Z","modified":"2025-11-03T19:27:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-cmvm-c7qf-pmc5","title":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the...","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","status":"published","published":"2023-01-17T18:30:43Z","modified":"2025-11-03T21:30:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T15:04:18.176646Z"}],"nvd":[{"id":"CVE-2022-41859","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","status":"published","published":"2023-01-17T18:15:11.287Z","modified":"2026-06-17T05:03:56.48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:07:35.157734Z"}],"osv":[{"id":"ALPINE-CVE-2022-41859","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","status":"published","published":"2023-01-17T18:15:11.287Z","modified":"2026-11-03T07:18:33.727348314Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-41859","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","status":"published","published":"2023-01-17T00:00:00Z","modified":"2026-10-28T02:30:35.533097672Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"OESA-2023-1953","title":"freeradius security update","description":"Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.\r\n\r\nSecurity Fix(es):\r\n\r\nIn freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.(CVE-2022-41859)","status":"published","published":"2023-12-22T11:06:24Z","modified":"2026-08-18T01:18:06.402123737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1954","title":"freeradius security update","description":"Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.\r\n\r\nSecurity Fix(es):\r\n\r\nIn freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.(CVE-2022-41859)","status":"published","published":"2023-12-22T11:06:24Z","modified":"2026-08-18T01:18:06.483680719Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1955","title":"freeradius security update","description":"Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.\r\n\r\nSecurity Fix(es):\r\n\r\nIn freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.(CVE-2022-41859)","status":"published","published":"2023-12-22T11:06:24Z","modified":"2026-08-18T01:18:06.498397052Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1956","title":"freeradius security update","description":"Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.\r\n\r\nSecurity Fix(es):\r\n\r\nIn freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.(CVE-2022-41859)","status":"published","published":"2023-12-22T11:06:24Z","modified":"2026-08-18T01:18:06.393509429Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2023:2166","title":"Red Hat Security Advisory: freeradius security and bug fix update","status":"published","published":"2024-09-16T09:07:04Z","modified":"2026-06-27T10:16:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2870","title":"Red Hat Security Advisory: freeradius:3.0 security update","status":"published","published":"2024-09-16T09:07:15Z","modified":"2026-06-27T10:17:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RLSA-2023:2870","title":"Moderate: freeradius:3.0 security update","description":"FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.\n\nSecurity Fix(es):\n\n* freeradius: Information leakage in EAP-PWD (CVE-2022-41859)\n\n* freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)\n\n* freeradius: Crash on invalid abinary data (CVE-2022-41861)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.","status":"published","published":"2026-06-26T18:00:57.979049Z","modified":"2026-06-26T18:24:13.288373953Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-41859","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","status":"published","published":"2023-01-17T18:15:00Z","modified":"2026-04-22T13:28:48.192927Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"ALSA-2023:2166","title":"Moderate: freeradius security and bug fix update","description":"FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.\n\nSecurity Fix(es):\n\n* freeradius: Information leakage in EAP-PWD (CVE-2022-41859)\n* freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)\n* freeradius: Crash on invalid abinary data (CVE-2022-41861)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:54.608103792Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2870","title":"Moderate: freeradius:3.0 security update","description":"FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.\n\nSecurity Fix(es):\n\n* freeradius: Information leakage in EAP-PWD (CVE-2022-41859)\n* freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)\n* freeradius: Crash on invalid abinary data (CVE-2022-41861)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:04.349548464Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"DEBIAN-CVE-2022-41859","description":"In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.","status":"published","published":"2023-01-17T18:15:11.287Z","modified":"2026-11-03T06:02:55.611698257Z","updated_at":"2026-11-03T06:43:19.563245Z"},{"id":"DLA-3342-1","title":"freeradius - security update","status":"published","published":"2023-02-24T00:00:00Z","modified":"2026-03-09T01:20:35.306089Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-4232-1","title":"freeradius - security update","status":"published","published":"2025-06-26T00:00:00Z","modified":"2026-03-09T02:11:32.498216Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2022-0482","title":"Updated freeradius packages fix security vulnerability","description":"Information leakage in EAP-PWD. (CVE-2022-41859)\nCrash on unknown option in EAP-SIM. (CVE-2022-41860)\nCrash on invalid abinary data. (CVE-2022-41861)\n","status":"published","published":"2022-12-30T22:39:00Z","modified":"2026-04-16T04:44:02.675774176Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13386-1","title":"freeradius-server-3.2.3-2.1 on GA media","description":"These are all security issues fixed in the freeradius-server-3.2.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:52.394371Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2022:4620-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).\n- CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).\n- CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).\n- move logrotate options into specific parts for each log as 'global' options\n  will persist past and clobber global options in the main logrotate config (bsc#1180525)\n- Fixed plaintext password entries in logfiles (bsc#1184016).\n","status":"published","published":"2022-12-27T07:04:14Z","modified":"2026-02-04T04:10:56.690677Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4621-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).\n- CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).\n- CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).\n","status":"published","published":"2022-12-27T07:04:35Z","modified":"2026-02-04T04:34:34.933534Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4622-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).\n- CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).\n- CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).\n","status":"published","published":"2022-12-27T07:05:34Z","modified":"2026-02-04T03:02:05.624732Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4626-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).\n- CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).\n- CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).\n\n- rebuild against the new net-snmp (jsc#SLE-11203).\n","status":"published","published":"2022-12-27T12:05:43Z","modified":"2026-02-04T03:36:11.198977Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0124-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2022-41859: Fixed an issue in EAP-PWD that could leak\n  information about the password, which could facilitate dictionary\n  attacks (bsc#1206204).\n- CVE-2022-41860: Fixed a crash in servers with EAP_SIM manually\n  configured, which could be triggered via a malformed SIM option\n  (bsc#1206205).\n- CVE-2022-41861: Fixed a server crash that could be triggered by\n  sending malformed data from a system in the RADIUS circle of trust\n  (bsc#1206206).\n","status":"published","published":"2023-01-23T12:39:24Z","modified":"2026-02-04T03:48:33.224943Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0135-1","title":"Security update for freeradius-server","description":"This update for freeradius-server fixes the following issues:\n\n- CVE-2022-41859: Fixed an issue in EAP-PWD that could leak\n  information about the password, which could facilitate dictionary\n  attacks (bsc#1206204).\n- CVE-2022-41860: Fixed a crash in servers with EAP_SIM manually\n  configured, which could be triggered via a malformed SIM option\n  (bsc#1206205).\n- CVE-2022-41861: Fixed a server crash that could be triggered by\n  sending malformed data from a system in the RADIUS circle of trust\n  (bsc#1206206).\n","status":"published","published":"2023-01-25T10:20:38Z","modified":"2026-02-04T02:26:42.957435Z","updated_at":"2026-11-02T15:53:51.853735Z"}]}}