Vulnetix
Try Vulnetix Request Demo
CVE-2017-9148 REJECTED

The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

EPSS 1.21% · 78.9th percentile

Risk Scores

EPSS Score
1.21%
78.9th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSfreeradius0, 2.1.12+dfsg-1.3ubuntu5, 2.2.8+dfsg-0.1
Ubuntu:14.04:LTSfreeradius2.1.12+dfsg-1.2ubuntu6, 2.1.12+dfsg-1.2ubuntu5, 2.1.12+dfsg-1.2ubuntu7

Timeline

References

Open in Interactive Console →