Описание
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 3.0.12+dfsg-5ubuntu1 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was not-affected [2.1.12+dfsg-1.2ubuntu8.1]] |
| esm-infra/xenial | not-affected | 2.2.8+dfsg-0.1build2 |
| precise/esm | DNE | |
| trusty | not-affected | 2.1.12+dfsg-1.2ubuntu8.1 |
| trusty/esm | DNE | trusty was not-affected [2.1.12+dfsg-1.2ubuntu8.1] |
| upstream | released | 3.0.12+dfsg-5 |
| vivid/stable-phone-overlay | DNE | |
| vivid/ubuntu-core | DNE | |
| xenial | not-affected | 2.2.8+dfsg-0.1build2 |
Показывать по
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before ...
7.5 High
CVSS2
9.8 Critical
CVSS3