Total vulnerabilities in the database
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.
| Software | From | Fixed in |
|---|---|---|
| freeradius / freeradius | 2.1.2 | 2.1.2.x |
| freeradius / freeradius | 3.0.5 | 3.0.5.x |
| freeradius / freeradius | 3.0.8 | 3.0.8.x |
| freeradius / freeradius | 3.0.1 | 3.0.1.x |
| freeradius / freeradius | 3.1.0 | 3.1.0.x |
| freeradius / freeradius | 4.0.0 | 4.0.0.x |
| freeradius / freeradius | 2.1.1 | 2.1.1.x |
| freeradius / freeradius | 2.1.4 | 2.1.4.x |
| freeradius / freeradius | 3.0.3 | 3.0.3.x |
| freeradius / freeradius | 3.0.6 | 3.0.6.x |
| freeradius / freeradius | 3.1.2 | 3.1.2.x |
| freeradius / freeradius | 3.0.0 | 3.0.0.x |
| freeradius / freeradius | 3.1.1 | 3.1.1.x |
| freeradius / freeradius | 2.1.7 | 2.1.7.x |
| freeradius / freeradius | 3.0.4 | 3.0.4.x |
| freeradius / freeradius | 3.0.2 | 3.0.2.x |
| freeradius / freeradius | 3.0.9 | 3.0.9.x |
| freeradius / freeradius | 2.1.3 | 2.1.3.x |
| freeradius / freeradius | 3.0.7 | 3.0.7.x |
| freeradius / freeradius | 3.1.3 | 3.1.3.x |
| freeradius / freeradius | 2.1.6 | 2.1.6.x |