CVE-2018-11574 — Improper Input Validation in Protocol Project Point-to-point Protocol
Severity
9.8CRITICALNVD
EPSS
0.4%
top 38.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJun 14
Latest updateMay 13
Description
Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the `refuse-app` option are unaffected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages3 packages
Also affects: Ubuntu Linux 14.04, 16.04, 18.04
Patches
🔴Vulnerability Details
2GHSA▶
GHSA-hx7c-3c6c-mhm3: Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure,↗2022-05-13
OSV▶
CVE-2018-11574: Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure,↗2018-06-14