CVE-2019-13456

Name of the Vulnerable Software and Affected Versions FreeRADIUS versions 3.0 through 3.0.19

Description The issue is related to errors in EAP-pwd authentication, which can lead to information leakage. This leakage is similar to the "Dragonblood" attack and can be used by an attacker to recover the password of any user. On average, 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. An attacker can exploit this vulnerability to obtain a password for authorization in a Wi-Fi network.

Recommendations For FreeRADIUS versions 3.0 through 3.0.19, at the moment, there is no information about a newer version that contains a fix for this vulnerability.