Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2019-17185 →
DEBIAN-CVE-2019-17185
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use t...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
freeradius
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20+dfsg-1"}]}]
Debian:13
freeradius
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20+dfsg-1"}]}]
Debian:14
freeradius
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org