CVE-2022-41859

Name	CVE-2022-41859
Description	In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3342-1, DLA-4232-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
freeradius (PTS)	bookworm	3.2.1+dfsg-4+deb12u1	fixed
	trixie	3.2.7+dfsg-1+deb13u2	fixed
	forky, sid	3.2.10+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
freeradius	source	buster	3.0.17+dfsg-1.1+deb10u2	DLA-3342-1
freeradius	source	bullseye	3.0.21+dfsg-2.2+deb11u2	DLA-4232-1
freeradius	source	(unstable)	3.2.0+dfsg-1

https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f912ad2da8ac6e176ac3a606333469937 (release_3_0_26)