Description
modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeradius | 2.1.12+dfsg-1.2 | — |
| Debian 13 | freeradius | 2.1.12+dfsg-1.2 | — |
| Debian 12 | freeradius | 2.1.12+dfsg-1.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | freeradius +8 | 2.1.12-3.el6 | RHBA-2012:0881 |
| RHEL 5 | freeradius2 +8 | 2.1.12-5.el5 | RHSA-2013:0134 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | freeradius | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | freeradius | No fix yet | — |
Advisories 2
- RHSA-2013:0134 Red Hat Security Advisory: freeradius2 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHBA-2012:0881 Red Hat Bug Fix Advisory: freeradius bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2013:0134 vendor-advisory
- http://rhn.redhat.com/errata/RHBA-2012-0881.html
- openSUSE-SU-2013:0137 vendor-advisory
- openSUSE-SU-2013:0191 vendor-advisory
- https://github.com/alandekok/freeradius-server/commit/1b1ec5ce75e224bd1755650c18ccdaa6dc53e605