In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
References
| Link | Resource |
|---|---|
| https://freeradius.org/security/ | Patch Vendor Advisory |
| https://freeradius.org/security/ | Patch Vendor Advisory |
| https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f | Patch Third Party Advisory |
| https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f | Patch Third Party Advisory |
Configurations
History
07 Apr 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f - Patch, Third Party Advisory | |
| References | () https://freeradius.org/security/ - Patch, Vendor Advisory |
Information
Published : 2023-01-17 18:15
Updated : 2025-04-07 17:15
NVD link : CVE-2022-41859
Mitre link : CVE-2022-41859
JSON object : View
Products Affected
freeradius
- freeradius
CWE
CWE-522
Insufficiently Protected Credentials