CVE-2022-41859 Information disclosure in freeradius
An attacker can exploit an information leak in FreeRADIUS EAP-PWD to significantly reduce the effort required for offline dictionary attacks against user passwords.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41859?
CVE-2022-41859 is a high-severity vulnerability in freeradius, published on 17 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
Which versions are affected by CVE-2022-41859?
It affects 1 product.
Products include Freeradius Freeradius.
How do I fix CVE-2022-41859?
Apply the vendor's patch.
Is CVE-2022-41859 being exploited?
There is no known exploitation of CVE-2022-41859 in the wild and no public exploit code.
Other vulnerabilities in freeradius
Sources
Also known as ALPINE-CVE-2022-41859, DEBIAN-CVE-2022-41859, GHSA-cmvm-c7qf-pmc5, OESA-2023-1953, OESA-2023-1954, OESA-2023-1955 and 2 more.