CVE-2022-41861 - Vulnerability Details - OpenCVE

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Freeradius	Freeradius
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
freeradius:3.0-8080020221214103624.89170a74	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:2870	2023-05-16T00:00:00Z
Red Hat Enterprise Linux 9
freeradius-0:3.0.21-37.el9	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:2166	2023-05-09T00:00:00Z

References

Link	Providers
https://freeradius.org/security/
https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e
https://lists.debian.org/debian-lts-announce/2025/06/msg00030.html
https://nvd.nist.gov/vuln/detail/CVE-2022-41861
https://www.cve.org/CVERecord?id=CVE-2022-41861

History

Mon, 03 Nov 2025 20:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/06/msg00030.html

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00296}`	epss `{'score': 0.00305}`

Mon, 07 Apr 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2023-01-17T00:00:00.000Z

Updated: 2025-11-03T19:27:40.244Z

Reserved: 2022-09-30T00:00:00.000Z

Link: CVE-2022-41861

Vulnrichment

Updated: 2025-11-03T19:27:40.244Z

NVD

Status : Modified

Published: 2023-01-17T18:15:11.480

Modified: 2025-11-03T20:15:57.830

Link: CVE-2022-41861

Redhat

Severity : Moderate

Publid Date: 2022-04-22T00:00:00Z

Links: CVE-2022-41861 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-41861", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2025-11-03T19:27:40.244Z", "dateReserved": "2022-09-30T00:00:00.000Z", "datePublished": "2023-01-17T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-01-17T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash."}], "affected": [{"vendor": "n/a", "product": "freeradius", "versions": [{"version": "All versions from 0.0.1 to 3.0.25", "status": "affected"}]}], "references": [{"url": "https://freeradius.org/security/"}, {"url": "https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-400", "cweId": "CWE-400"}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://freeradius.org/security/", "tags": ["x_transferred"]}, {"url": "https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00030.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:27:40.244Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-07T16:27:46.890633Z", "id": "CVE-2022-41861", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T16:28:17.085Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://freeradius.org/security/", "tags": ["x_transferred"]}, {"url": "https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00030.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:27:40.244Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-41861", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-07T16:27:46.890633Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T16:28:12.778Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "freeradius", "versions": [{"status": "affected", "version": "All versions from 0.0.1 to 3.0.25"}]}], "references": [{"url": "https://freeradius.org/security/"}, {"url": "https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e"}], "descriptions": [{"lang": "en", "value": "A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-01-17T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-41861", "state": "PUBLISHED", "dateUpdated": "2025-11-03T19:27:40.244Z", "dateReserved": "2022-09-30T00:00:00.000Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2023-01-17T00:00:00.000Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*", "matchCriteriaId": "904C69B2-4BA4-47FB-8B0D-0780AE90ADA4", "versionEndIncluding": "3.0.25", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash."}, {"lang": "es", "value": "Se encontr\u00f3 un defecto en freeradius. Un cliente RADIUS o un servidor dom\u00e9stico malicioso puede enviar un atributo binario con formato incorrecto que puede provocar que el servidor falle."}], "id": "CVE-2022-41861", "lastModified": "2025-11-03T20:15:57.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-01-17T18:15:11.480", "references": [{"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://freeradius.org/security/"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://freeradius.org/security/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00030.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}