freeradius vulnerabilities and fixes

Recent CVEs affecting freeradius, with upgrade or downgrade steps. 47 tracked.

freeradius has 47 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 16. Most recent: 2024-07-09. Highest priority: CVE-2019-11234 (score 68/100).

• CVE-2024-3596 CRITICAL 9.0 UPGRADE MITIGATE RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid
• CVE-2022-41861 MEDIUM 6.5 UPGRADE A flaw was found in freeradius
• CVE-2022-41860 HIGH 7.5 UPGRADE In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option
• CVE-2022-41859 HIGH 7.5 UPGRADE In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allo
• CVE-2019-17185 HIGH 7.5 UPGRADE MITIGATE In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all hand
• CVE-2019-13456 MEDIUM 6.5 UPGRADE MITIGATE In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password ele
• CVE-2019-11235 CRITICAL 9.8 UPGRADE MITIGATE FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range,
• CVE-2019-11234 CRITICAL 9.8 UPGRADE MITIGATE FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" i
• CVE-2019-10143 HIGH 7.0 UPGRADE MITIGATE It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowi
• CVE-2017-9148 CRITICAL 9.8 DOWNGRADE The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0
• CVE-2017-10987 HIGH 7.5 DOWNGRADE An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboption
• CVE-2017-10986 HIGH 7.5 DOWNGRADE An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denia
• CVE-2017-10985 HIGH 7.5 DOWNGRADE An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' a
• CVE-2017-10984 CRITICAL 9.8 DOWNGRADE An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows re
• CVE-2017-10983 HIGH 7.5 DOWNGRADE An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when dec
• CVE-2017-10982 HIGH 7.5 DOWNGRADE An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()
• CVE-2017-10981 HIGH 7.5 DOWNGRADE An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr_dhcp_decode()" and a denia
• CVE-2017-10980 HIGH 7.5 DOWNGRADE An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode_tlv()" and a denial of
• CVE-2017-10979 CRITICAL 9.8 DOWNGRADE An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows rem
• CVE-2017-10978 HIGH 7.5 UPGRADE MITIGATE An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make
• CVE-2015-8764 HIGH 8.1 DOWNGRADE Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow.
• CVE-2015-8763 HIGH 8.1 DOWNGRADE The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a cr
• CVE-2015-8762 MEDIUM 5.9 DOWNGRADE The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to cause a denial of service (NULL
• CVE-2015-4680 HIGH 7.5 DOWNGRADE MITIGATE FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA cer
• CVE-2014-2015 HIGH 7.5 DOWNGRADE Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeR
• CVE-2012-3547 MEDIUM 6.8 DOWNGRADE Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-b
• CVE-2011-4966 MEDIUM 6.0 UPGRADE modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, doe
• CVE-2011-2701 MEDIUM 5.8 DOWNGRADE The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse r
• CVE-2010-3697 MEDIUM 4.3 DOWNGRADE The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x before 2.1.10, in certain circumstances
• CVE-2010-3696 MEDIUM 4.3 DOWNGRADE The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properl
• CVE-2009-3111 MEDIUM 5.0 UPGRADE The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiu
• CVE-2008-4474 HIGH 7.2 DOWNGRADE freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attac
• CVE-2007-2028 MEDIUM 5.0 UPGRADE Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consu
• CVE-2007-0080 MEDIUM 6.6 UPGRADE Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute
• CVE-2006-1354 HIGH 7.5 DOWNGRADE Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or
• CVE-2005-4746 HIGH 7.8 DOWNGRADE Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service (cra
• CVE-2005-4745 HIGH 7.5 DOWNGRADE SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers
• CVE-2005-4744 MEDIUM 6.4 DOWNGRADE Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versi
• CVE-2005-1455 HIGH 7.5 DOWNGRADE Buffer overflow in the sql_escape_func function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remo
• CVE-2005-1454 HIGH 7.5 DOWNGRADE SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier all
• CVE-2004-0961 MEDIUM 5.0 DOWNGRADE MITIGATE Memory leak in FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (memory exhaustion
• CVE-2004-0960 MEDIUM 5.0 DOWNGRADE MITIGATE FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR ven
• CVE-2004-0938 MEDIUM 5.0 UPGRADE FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Asce
• CVE-2003-0967 MEDIUM 5.0 UPGRADE rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a
• CVE-2002-0318 MEDIUM 5.0 MITIGATE FreeRADIUS RADIUS server allows remote attackers to cause a denial of service (CPU consumption) via a flood of
• CVE-2001-1377 MEDIUM 5.0 DOWNGRADE DOWNGRADE Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, w
• CVE-2001-1376 HIGH 7.5 DOWNGRADE DOWNGRADE Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to c

FAQ

How do I fix freeradius vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is freeradius being exploited right now?

None of the tracked freeradius CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which freeradius CVE should I patch first?

CVE-2019-11234 currently ranks highest (68/100): FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" i.

RSS feed for freeradius · ← Back to latest CVEs