CVE-2019-11234: Critical severity FreeRADIUS freeradius vulnerability
A vulnerability was found in FreeRadius. An attacker can reflect the received scalar and element from the server in it's own commit message, and subsequently reflect the confirm value as well. This causes the adversary to successfully authenticate as the victim. Fortunately, the adversary will not posses the negotiated session key, meaning the adversary cannot actually perform any actions as this user.
Other sources
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11234?
The severity of CVE-2019-11234 has been classified as moderate.
How do I fix CVE-2019-11234?
To fix CVE-2019-11234, upgrade FreeRadius to version 3.0.21 or later, or to any version 3.2.1 or greater.
What systems are affected by CVE-2019-11234?
CVE-2019-11234 affects FreeRadius versions up to 3.0.19 and several distributions including Red Hat, Debian, and Ubuntu.
Can CVE-2019-11234 allow attackers to impersonate users?
Yes, CVE-2019-11234 allows attackers to authenticate as legitimate users by reflecting commit messages.
Is CVE-2019-11234 a known vulnerability in FreeRadius?
Yes, CVE-2019-11234 is a recognized vulnerability that has been documented and identified in FreeRadius.