PT-2017-18730

Name of the Vulnerable Software and Affected Versions FreeRADIUS versions 2.1.1 through 2.1.7 FreeRADIUS versions 3.0.x before 3.0.14 FreeRADIUS versions 3.1.x before 2017-02-04 FreeRADIUS versions 4.0.x before 2017-02-04 Description The issue concerns the TLS session cache, which fails to preven...

FreeRADIUS -- TLS resumption authentication bypass

Stefan Winter reports: The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers such as malicious 802.1X supplicants to bypass authentication via PEAP or TTLS...