CVE-2019-17185
published 2020-03-21CVE-2019-17185: In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.17%
80.2th percentile
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freeradius | < freeradius 3.0.20+dfsg-1 (bookworm) | freeradius 3.0.20+dfsg-1 (bookworm) |
| freeradius | freeradius | >= 0 < 3.0.20+dfsg-1 | 3.0.20+dfsg-1 |
| freeradius | freeradius | >= 0 < 3.0.20+dfsg-1 | 3.0.20+dfsg-1 |
| freeradius | freeradius | >= 0 < 3.0.20+dfsg-1 | 3.0.20+dfsg-1 |
| freeradius | freeradius | >= 0 < 3.0.20+dfsg-1 | 3.0.20+dfsg-1 |
| freeradius | freeradius | >= 0 < 3.0.16+dfsg-1ubuntu3.2 | 3.0.16+dfsg-1ubuntu3.2 |
| freeradius | freeradius | >= 0 < 3.0.20+dfsg-3ubuntu0.2 | 3.0.20+dfsg-3ubuntu0.2 |
| freeradius | freeradius | >= 0 < 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.1 | 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.1 |
| freeradius | freeradius | >= 0 < 2.2.8+dfsg-0.1ubuntu0.1+esm1 | 2.2.8+dfsg-0.1ubuntu0.1+esm1 |
| freeradius | freeradius | >= 3.0.0 < 3.0.20 | 3.0.20 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
freeradius vulnerabilities
osv·2023-01-04·CVSS 7.5
CVE-2019-17185 [HIGH] freeradius vulnerabilities
freeradius vulnerabilities
It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd
handshakes. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17185)
Shane Guan discovered that FreeRADIUS incorrectly handled memory when
checking unknown SIM option sent by EAP-SIM supplicant. An attacker could
possibly use this issue to cause a denial of service on the server. This
issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2022-41860)
It was discovered that FreeRADIUS incorrectly handled memory when
processing certain abinary attributes. An attacker could possibly use this
issue to cause a denial of service on the server. (CVE-2022-41861)
GHSA
GHSA-h63v-34h7-7q42: In FreeRADIUS 3
ghsa_unreviewed·2022-05-24
CVE-2019-17185 [MEDIUM] CWE-20 GHSA-h63v-34h7-7q42: In FreeRADIUS 3
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
OSV
CVE-2019-17185: In FreeRADIUS 3
osv·2020-03-21·CVSS 7.5
CVE-2019-17185 [HIGH] CVE-2019-17185: In FreeRADIUS 3
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
Ubuntu
FreeRADIUS vulnerabilities
vendor_ubuntu·2023-01-04·CVSS 7.5
CVE-2019-17185 [HIGH] FreeRADIUS vulnerabilities
Title: FreeRADIUS vulnerabilities
Summary: Several security issues were fixed in FreeRADIUS.
It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd
handshakes. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17185)
Shane Guan discovered that FreeRADIUS incorrectly handled memory when
checking unknown SIM option sent by EAP-SIM supplicant. An attacker could
possibly use this issue to cause a denial of service on the server. This
issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2022-41860)
It was discovered that FreeRADIUS incorrectly handled memory when
processing certain abinary attributes. An attacker could possibly use this
issue to cause a denial of service o
Red Hat
freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access
vendor_redhat·2019-11-14·CVSS 7.5
CVE-2019-17185 [HIGH] CWE-567 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access
freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
Package: freeradius (Red Hat Enterprise Linux 5) - Not affected
Package: freeradius2 (Red Hat Enterprise Linux 5) - Not affected
Package: freeradius (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2019-17185: freeradius - In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_C...
vendor_debian·2019·CVSS 7.5
CVE-2019-17185 [HIGH] CVE-2019-17185: freeradius - In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_C...
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
Scope: local
bookworm: resolved (fixed in 3.0.20+dfsg-1)
bullseye: resolved (fixed in 3.0.20+dfsg-1)
forky: resolved (fixed in 3.0.20+dfsg-1)
sid: resolved (fixed in 3.0.20+dfsg-1)
trixie: resolved (fixed in 3.0.20+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-17185 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access [fedora-all]
bugzilla·2020-03-24·CVSS 7.5
CVE-2019-17185 [HIGH] CVE-2019-17185 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access [fedora-all]
CVE-2019-17185 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Bugzilla
CVE-2019-17185 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access
bugzilla·2020-03-24·CVSS 7.5
CVE-2019-17185 [HIGH] CVE-2019-17185 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access
CVE-2019-17185 freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
Reference:
https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_20
Discussion:
Created freeradius tracking bugs for this issue:
Affects: fedora-all [bug 1816681]
---
Upstream fix :
https://github.com/FreeRADIUS/freeradius-server/commit/6b522f8780813726799e6b8cf0f1f8e0ce2c8ebf
---
Freeradius versions 2.x and older are not vulnerable, because they do not sup
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.htmlhttps://freeradius.org/security/https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_20http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.htmlhttps://freeradius.org/security/https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_20
2020-03-21
Published