Most recent entries from all

ALSA-2023:2166 — Moderate: freeradius security and bug fix update

Affected: AlmaLinux:9: freeradius, AlmaLinux:9: freeradius-devel, AlmaLinux:9: freeradius-doc, AlmaLinux:9: freeradius-krb5, AlmaLinux:9: freeradius-ldap, AlmaLinux:9: freeradius-mysql, AlmaLinux:9: freeradius-perl, AlmaLinux:9: freeradius-postgresql, AlmaLinux:9: freeradius-rest, AlmaLinux:9: freeradius-sqlite and 3 more

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

* freeradius: Information leakage in EAP-PWD (CVE-2022-41859) * freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860) * freeradius: Crash on invalid abinary data (CVE-2022-41861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

EUVD-2026-257689

fkie_cve-2022-41859

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.

GHSA-cmvm-c7qf-pmc5

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.

gsd-2022-41859

OESA-2023-1953 — freeradius security update

Affected: openEuler:20.03-LTS-SP1: freeradius

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service. Security Fix(es): In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.(CVE-2022-41859)

openSUSE-SU-2024:13386-1 — freeradius-server-3.2.3-2.1 on GA media

freeradius-server-3.2.3-2.1 on GA media

RLSA-2023:2870 — Moderate: freeradius:3.0 security update

Affected: Rocky Linux:8: freeradius

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

* freeradius: Information leakage in EAP-PWD (CVE-2022-41859)

* freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)

* freeradius: Crash on invalid abinary data (CVE-2022-41861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

SUSE-SU-2022:4620-1 — Security update for freeradius-server

Security update for freeradius-server

UBUNTU-CVE-2022-41859

Affected: Ubuntu:18.04:LTS: freeradius, Ubuntu:20.04:LTS: freeradius

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.

WID-SEC-W-2022-2411 — FreeRADIUS: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FreeRADIUS ausnutzen, um Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.