PT-2020-10486

Name of the Vulnerable Software and Affected Versions FreeRADIUS versions prior to 3.0.20 Description The issue is related to a side-channel information leak in the EAP-pwd implementation, specifically in the rlm eap/types/rlm eap pwd/eap pwd.c file. This leak is associated with the Hunting and...

CVE-2019-13456: Observable Discrepancy

In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is...