REDHAT-BUG-2078483: Medium severity FreeRADIUS freeradius vulnerability
The EAP-PWD function computepasswordelement() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
References:
https://freeradius.org/security/
Upstream fix:
https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to take advantage of this issue?
The issue supports an offline dictionary attack against EAP-PWD passwords. An attacker would need information that allows them to perform password guessing offline; the provided data does not specify how that information is obtained.
Which authentication method is affected?
The affected function is part of EAP-PWD. The provided data does not establish whether other FreeRADIUS authentication methods are affected.
What is the practical impact of the information leak?
The leak substantially reduces the search space for an offline dictionary attack, making password guessing more efficient. The data does not state that the vulnerability directly reveals the password.