openEuler 20.03 LTS SP3 update for freeradius
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2022-41859 |
| CWE-ID | CWE-200 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
openEuler Operating systems & Components / Operating system freeradius-sqlite Operating systems & Components / Operating system package or component freeradius-utils Operating systems & Components / Operating system package or component freeradius-help Operating systems & Components / Operating system package or component freeradius-mysql Operating systems & Components / Operating system package or component freeradius-debuginfo Operating systems & Components / Operating system package or component freeradius-postgresql Operating systems & Components / Operating system package or component freeradius-perl Operating systems & Components / Operating system package or component python2-freeradius Operating systems & Components / Operating system package or component freeradius-ldap Operating systems & Components / Operating system package or component freeradius-debugsource Operating systems & Components / Operating system package or component freeradius-krb5 Operating systems & Components / Operating system package or component freeradius-devel Operating systems & Components / Operating system package or component freeradius Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Information disclosure
EUVDB-ID: #VU70504
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-41859
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the compute_password_element() function leaks information about the password. A remote attacker can substantially reduce
the size of an offline dictionary attack and brute-force passwords.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP3
freeradius-sqlite: before 3.0.15-27
freeradius-utils: before 3.0.15-27
freeradius-help: before 3.0.15-27
freeradius-mysql: before 3.0.15-27
freeradius-debuginfo: before 3.0.15-27
freeradius-postgresql: before 3.0.15-27
freeradius-perl: before 3.0.15-27
python2-freeradius: before 3.0.15-27
freeradius-ldap: before 3.0.15-27
freeradius-debugsource: before 3.0.15-27
freeradius-krb5: before 3.0.15-27
freeradius-devel: before 3.0.15-27
freeradius: before 3.0.15-27
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP3:*:*:*:*:*:
- cpe:2.3:o:openeuler:freeradius-sqlite:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-utils:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-help:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-mysql:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-debuginfo:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-postgresql:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-perl:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:python2-freeradius:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-ldap:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-debugsource:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-krb5:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius-devel:*:*:*:*:*:openeuler:*:
- cpe:2.3:o:openeuler:freeradius:*:*:*:*:*:openeuler:*:
http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1954
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
