Description
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.
References (5)
Core 5
Core References
Vendor Advisory x_refsource_misc
https://freeradius.org/security/
Exploit, Third Party Advisory x_refsource_misc
https://wpa3.mathyvanhoef.com
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1737663
Patch, Third Party Advisory x_refsource_confirm
https://github.com/FreeRADIUS/freeradius-server/commit/3ea2a5a026e73d81cd9a3e9bbd4300c433004bfa
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html
Scores
CVSS v3
6.5
EPSS
0.0025
EPSS Percentile
48.1%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-203
Status
published
Products (4)
freeradius/freeradius
3.0.0 - 3.0.19
opensuse/leap
15.1
redhat/enterprise_linux
7.0
redhat/enterprise_linux
8.0
Published
Dec 03, 2019
Tracked Since
Feb 18, 2026