Description
Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeradius | 2.1.12+dfsg-1.1 | — |
| Debian 13 | freeradius | 2.1.12+dfsg-1.1 | — |
| Debian 12 | freeradius | 2.1.12+dfsg-1.1 | — |
| Debian 6.0 | freeradius | 2.1.10+dfsg-2+squeeze1 | DSA-2546-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | freeradius +8 | 2.1.12-4.el6_3 | RHSA-2012:1326 |
| RHEL 5 | freeradius2 +8 | 2.1.12-4.el5_8 | RHSA-2012:1327 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | freeradius-server | 3.0.12-1.1 | openSUSE-SU-2024:10053-1 |
Advisories 4
- RHSA-2012:1327 Red Hat Security Advisory: freeradius2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:1326 Red Hat Security Advisory: freeradius security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2546-1 freeradius - code execution Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10053-1 freeradius-server-3.0.12-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 50584 third-party-advisory
- APPLE-SA-2013-10-22-5 vendor-advisory
- 50637 third-party-advisory
- USN-1585-1 vendor-advisory
- RHSA-2012:1327 vendor-advisory
- 50484 third-party-advisory
- DSA-2546 vendor-advisory
- 55483 vdb-entry
- 1027509 vdb-entry
- http://www.pre-cert.de/advisories/PRE-SA-2012-06.txt
- 20120910 [PRE-SA-2012-06] FreeRADIUS: Stack Overflow in TLS-based EAP Methods mailing-list
- [oss-security] 20120910 [PRE-SA-2012-06] FreeRADIUS: Stack Overflow in TLS-based EAP Methods mailing-list
- MDVSA-2012:159 vendor-advisory
- openSUSE-SU-2012:1200 vendor-advisory
- freeradius-cbtlsverify-bo(78408) vdb-entry
- RHSA-2012:1326 vendor-advisory
- 85325 vdb-entry
- 50770 third-party-advisory
- http://freeradius.org/security.html
- FEDORA-2012-15743 vendor-advisory