OESA-2021-1031

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1031
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2021-1031.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2021-1031
Upstream
Published
2021-02-05T11:02:36Z
Modified
2025-08-12T05:04:15.470040Z
Summary
freeradius security update
Details

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.\r\n\r\n Security Fix(es):\r\n\r\n In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.(CVE-2019-13456)\r\n\r\n In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BNCTX instance to handle all handshakes. This mean multiple threads use the same BNCTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.(CVE-2019-17185)\r\n\r\n

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS / freeradius

Package

Name
freeradius
Purl
pkg:rpm/openEuler/freeradius&distro=openEuler-20.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.15-22.oe1

Ecosystem specific 

{
    "src": [
        "freeradius-3.0.15-21.oe1.src.rpm",
        "freeradius-3.0.15-22.oe1.src.rpm"
    ],
    "x86_64": [
        "freeradius-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-debuginfo-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-debugsource-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-devel-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-help-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-krb5-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-ldap-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-mysql-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-perl-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-postgresql-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-sqlite-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-utils-3.0.15-21.oe1.x86_64.rpm",
        "python2-freeradius-3.0.15-21.oe1.x86_64.rpm",
        "freeradius-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-debuginfo-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-debugsource-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-devel-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-help-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-krb5-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-ldap-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-mysql-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-perl-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-postgresql-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-sqlite-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-utils-3.0.15-22.oe1.x86_64.rpm"
    ],
    "aarch64": [
        "freeradius-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-debuginfo-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-debugsource-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-devel-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-help-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-krb5-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-ldap-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-mysql-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-perl-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-postgresql-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-sqlite-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-utils-3.0.15-21.oe1.aarch64.rpm",
        "python2-freeradius-3.0.15-21.oe1.aarch64.rpm",
        "freeradius-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-debuginfo-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-debugsource-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-devel-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-help-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-krb5-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-ldap-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-mysql-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-perl-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-postgresql-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-sqlite-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-utils-3.0.15-22.oe1.aarch64.rpm"
    ]
}

openEuler:20.03-LTS-SP1 / freeradius

Package

Name
freeradius
Purl
pkg:rpm/openEuler/freeradius&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.15-22.oe1

Ecosystem specific 

{
    "src": [
        "freeradius-3.0.15-22.oe1.src.rpm"
    ],
    "x86_64": [
        "freeradius-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-debuginfo-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-debugsource-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-devel-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-help-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-krb5-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-ldap-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-mysql-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-perl-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-postgresql-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-sqlite-3.0.15-22.oe1.x86_64.rpm",
        "freeradius-utils-3.0.15-22.oe1.x86_64.rpm"
    ],
    "aarch64": [
        "freeradius-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-debuginfo-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-debugsource-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-devel-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-help-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-krb5-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-ldap-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-mysql-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-perl-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-postgresql-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-sqlite-3.0.15-22.oe1.aarch64.rpm",
        "freeradius-utils-3.0.15-22.oe1.aarch64.rpm"
    ]
}