Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

ubuntu логотип

CVE-2019-17185

Опубликовано: 21 мар. 2020
Источник: ubuntu
Приоритет: low
EPSS Низкий
CVSS2: 5
CVSS3: 7.5

Описание

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

РелизСтатусПримечание
bionic

released

3.0.16+dfsg-1ubuntu3.2
devel

not-affected

3.0.20+dfsg-3build1
eoan

ignored

end of life
esm-infra-legacy/trusty

DNE

esm-infra/bionic

released

3.0.16+dfsg-1ubuntu3.2
esm-infra/focal

not-affected

3.0.20+dfsg-3build1
esm-infra/xenial

not-affected

code not present
focal

not-affected

3.0.20+dfsg-3build1
groovy

not-affected

3.0.20+dfsg-3build1
hirsute

not-affected

3.0.20+dfsg-3build1

Показывать по

EPSS

Процентиль: 63%
0.0046
Низкий

5 Medium

CVSS2

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 7.5
redhat
около 6 лет назад

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

CVSS3: 7.5
nvd
больше 5 лет назад

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

CVSS3: 7.5
debian
больше 5 лет назад

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global Op ...

rocky
около 5 лет назад

Moderate: freeradius:3.0 security and bug fix update

CVSS3: 7.5
github
больше 3 лет назад

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

EPSS

Процентиль: 63%
0.0046
Низкий

5 Medium

CVSS2

7.5 High

CVSS3