Information disclosure in FreeRADIUS - CVE-2022-41859

Vulnerability identifier: #VU70504

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41859

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the compute_password_element() function leaks information about the password. A remote attacker can substantially reduce the size of an offline dictionary attack and brute-force passwords.

FreeRADIUS
Oracle Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
openEuler
Fedora
freeradius-server-mysql-debuginfo
freeradius-server-debuginfo
freeradius-server-debugsource
freeradius-server-doc
freeradius-server-krb5
freeradius-server-krb5-debuginfo
freeradius-server-ldap
freeradius-server-ldap-debuginfo
freeradius-server-libs
freeradius-server-libs-debuginfo
freeradius-server-mysql
freeradius-server
freeradius-server-perl
freeradius-server-perl-debuginfo
freeradius-server-postgresql
freeradius-server-postgresql-debuginfo
freeradius-server-python
freeradius-server-python-debuginfo
freeradius-server-utils-debuginfo
freeradius-server-utils
freeradius-server-sqlite-debuginfo
freeradius-server-sqlite
freeradius-krb5
freeradius-perl
python2-freeradius
freeradius-ldap
freeradius-debugsource
freeradius-sqlite
freeradius
freeradius-postgresql
freeradius-devel
freeradius-mysql
freeradius-help
freeradius-utils
freeradius-debuginfo
freeradius-server-devel
python3-freeradius
freeradius-unixODBC
freeradius-rest
freeradius-doc
freeradius (Red Hat package)
freeradius-server-python3-debuginfo
freeradius-server-python3
freeradius-server-ldap-schemas
RSA Authentication Manager

Install updates from vendor's website.

FreeRADIUS - update to 3.0.26
freeradius-server-mysql-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-debugsource - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-doc - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-krb5 - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-krb5-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-ldap - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-ldap-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-libs - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-libs-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-mysql - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-perl - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-perl-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-postgresql - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-postgresql-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-python - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1
freeradius-server-python-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1
freeradius-server-utils-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-utils - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-sqlite-debuginfo - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-sqlite - addressed in versions 3.0.3-17.18.1, 3.0.15-2.23.1, 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-krb5 - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-perl - addressed in versions 3.0.15-27, 3.0.25-2
python2-freeradius - update to 3.0.15-27
freeradius-ldap - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-debugsource - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-sqlite - addressed in versions 3.0.15-27, 3.0.25-2
freeradius - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-postgresql - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-devel - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-mysql - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-help - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-utils - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-debuginfo - addressed in versions 3.0.15-27, 3.0.25-2
freeradius-server-devel - addressed in versions 3.0.16-150000.3.13.1, 3.0.19-3.12.1, 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius - update to 3.0.20-14
python3-freeradius - update to 3.0.20-14
freeradius-utils - update to 3.0.20-14
freeradius-unixODBC - update to 3.0.20-14
freeradius-sqlite - update to 3.0.20-14
freeradius-rest - update to 3.0.20-14
freeradius-postgresql - update to 3.0.20-14
freeradius-perl - update to 3.0.20-14
freeradius-mysql - update to 3.0.20-14
freeradius-ldap - update to 3.0.20-14
freeradius-krb5 - update to 3.0.20-14
freeradius-doc - update to 3.0.20-14
freeradius-devel - update to 3.0.20-14
freeradius (Red Hat package) - update to 3.0.21-37.el9
freeradius-server-python3-debuginfo - addressed in versions 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
freeradius-server-python3 - addressed in versions 3.0.21-150200.3.12.1, 3.0.25-150400.4.4.1
python3-freeradius - update to 3.0.25-2
freeradius-server-ldap-schemas - update to 3.0.25-150400.4.4.1
freeradius - update to 3.0.26-1.fc36
RSA Authentication Manager - update to 8.7 Patch 3

• https://freeradius.org/security/
• https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f

• Multiple vulnerabilities in FreeRADIUS
• SUSE update for freeradius-server
• SUSE update for freeradius-server
• SUSE update for freeradius-server
• SUSE update for freeradius-server
• SUSE update for freeradius-server
• SUSE update for freeradius-server
• Red Hat Enterprise Linux 9 update for freeradius
• Red Hat Enterprise Linux 8 update for the freeradius:3.0 module
• Multiple vulnerabilities in Oracle Linux
• openEuler 20.03 LTS SP1 update for freeradius
• openEuler 20.03 LTS SP3 update for freeradius
• openEuler 22.03 LTS update for freeradius
• openEuler 20.03 LTS SP4 update for freeradius
• Fedora 36 update for freeradius
• Anolis OS update for freeradius:3.0 module
• RSA Authentication Manager update for third-party components