CVE-2021-32642

uninett radsecproxy, fedoraproject fedora

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-32642

Katalog CVE

CVSS 9.4 · Critical EPSS 1,3%

Kerentanan Improper Input Validation pada uninett radsecproxy, fedoraproject fedora. Skor CVSS 3.1 9.4 (Critical) menurut NVD.

Deskripsi (NVD)

radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `naptr-eduroam.sh` and `radsec-dynsrv.sh` scripts can lead to configuration injection via crafted radsec peer discovery DNS records. Users are subject to Information disclosure, Denial of Service, Redirection of Radius connection to a non-authenticated server leading to non-authenticated network access. Updated example scripts are available in the master branch and 1.9 release. Note that the scripts are not part of the installation package and are not updated automatically. If you are using the examples, you have to update them manually. The dyndisc scripts work independently of the radsecproxy code. The updated scripts can be used with any version of radsecproxy.

Rincian

Terbit di NVD
28 Mei 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.4 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-20: Improper Input Validation
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari)
1,3% peluang dieksploitasi; lebih tinggi dari 70,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
uninett radsecproxy Semua versi sebelum 1.9.0
fedoraproject fedora Versi 33
fedoraproject fedora Versi 34

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.