DEBIAN-CVE-2019-17185

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BNCTX instance to handle all handshakes. This mean multiple threads use the same BNCTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a...

PT-2020-9878

Name of the Vulnerable Software and Affected Versions FreeRADIUS versions 3.0.x through 3.0.19 Description The EAP-pwd module in FreeRADIUS used a global OpenSSL BN CTX instance to handle all handshakes, resulting in multiple threads using the same instance concurrently. This leads to crashes whe...