CVE-2017-9148

Published: May 29, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

Affected (21)

Products: Freeradius: Freeradius

Freeradius

1 product

Freeradius

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Freeradius Freeradius	Version 2.1.1
Freeradius Freeradius	Version 2.1.2
Freeradius Freeradius	Version 2.1.3
Freeradius Freeradius	Version 2.1.4
Freeradius Freeradius	Version 2.1.6
Freeradius Freeradius	Version 2.1.7
Freeradius Freeradius	Version 3.0.0
Freeradius Freeradius	Version 3.0.1
Freeradius Freeradius	Version 3.0.2
Freeradius Freeradius	Version 3.0.3
Freeradius Freeradius	Version 3.0.4
Freeradius Freeradius	Version 3.0.5
Freeradius Freeradius	Version 3.0.6
Freeradius Freeradius	Version 3.0.7
Freeradius Freeradius	Version 3.0.8
Freeradius Freeradius	Version 3.0.9
Freeradius Freeradius	Version 3.1.0
Freeradius Freeradius	Version 3.1.1
Freeradius Freeradius	Version 3.1.2
Freeradius Freeradius	Version 3.1.3
Freeradius Freeradius	Version 4.0.0