p PatchFirst

CVE-2022-41860

CVE-2022-41860

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

CVSS 7.5 · High · EPSS 1.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • freeradius

    Versions
    • All versions from 0.9.3 to 3.0.25: Affected

    No fix published

  • freeradius Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.2.0+dfsg-1

    Update to 3.2.0+dfsg-1

  • freeradius Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.2.0+dfsg-1

    Update to 3.2.0+dfsg-1

  • freeradius Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.2.0+dfsg-1

    Update to 3.2.0+dfsg-1

  • freeradius Ubuntu:Pro:16.04:LTS

    Versions
    • 2.1.12+dfsg-1.3ubuntu5
    • 2.2.8+dfsg-0.1
    • 2.2.8+dfsg-0.1build1
    • 2.2.8+dfsg-0.1build2
    • 2.2.8+dfsg-0.1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 2.2.8+dfsg-0.1ubuntu0.1+esm1

    Update to 2.2.8+dfsg-0.1ubuntu0.1+esm1

  • freeradius Ubuntu:18.04:LTS

    Versions
    • 3.0.15+dfsg-1ubuntu2
    • 3.0.16+dfsg-1ubuntu2
    • 3.0.16+dfsg-1ubuntu3
    • 3.0.16+dfsg-1ubuntu3.1
    Affected ranges
    • ECOSYSTEM: < 3.0.16+dfsg-1ubuntu3.2

    Update to 3.0.16+dfsg-1ubuntu3.2

  • freeradius Ubuntu:20.04:LTS

    Versions
    • 3.0.19+dfsg-3
    • 3.0.19+dfsg-3build1
    • 3.0.20+dfsg-1
    • 3.0.20+dfsg-3
    • 3.0.20+dfsg-3build1
    • 3.0.20+dfsg-3ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 3.0.20+dfsg-3ubuntu0.2

    Update to 3.0.20+dfsg-3ubuntu0.2

Original sources

Check your server →