# CVE-2019-11235: freeradius: FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) ser...

CVE-2019-11235 is fixed in 20 products on 1 platform, first by freeradius 3.0.16+dfsg-1ubuntu3.1, released April 15, 2019. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2019-11235
- Priority: High
- CVSS: 9.8 (Important)
- EPSS: 0.0357
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 15, 2019

## Description

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.  Security Fix(es):  * freeradius: eap-pwd: authentication bypass via an invalid curve attack (CVE-2019-11235)  * freeradius: eap-pwd: fake authentication using reflection (CVE-2019-11234)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | freeradius RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-common Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-common 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-common-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-config Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-config 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-config-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-devel RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-devel ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-dhcp Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-dhcp 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-dhcp-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-doc RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-doc ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-iodbc Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-iodbc 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-iodbc-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-krb5 RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-krb5 Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-krb5 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-krb5-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-krb5 ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-ldap RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-ldap Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-ldap 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-ldap-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-ldap ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-memcached Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-memcached 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-memcached-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-mysql RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-mysql Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-mysql 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-mysql-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-mysql ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-perl RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-perl ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-postgresql RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-postgresql Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-postgresql 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-postgresql-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-postgresql ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-redis Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-redis 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-redis-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-rest RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-rest Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-rest 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-rest-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-rest ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-sqlite RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-sqlite ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-unixODBC RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-unixODBC ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-utils RHEL 8 | 0:3.0.17-4.module+el8.0.0+3108+851cb559 | [RHSA-2019:1142](https://patchblox.com/security/data/fix/linux/rhsa-2019-1142.md) | May 13, 2019 |
| Linux | freeradius-utils Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-utils 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-utils-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | freeradius-utils ol 8 | 0:3.0.17-4.module+el8.0.0+5208+733fb731 | [ELSA-2019-1142](https://patchblox.com/security/data/fix/linux/elsa-2019-1142.md) | Jul 30, 2019 |
| Linux | freeradius-yubikey Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [freeradius-yubikey 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-freeradius-yubikey-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |
| Linux | libfreeradius3 Ubuntu 18.04.6 LTS (bionic) | 3.0.16+dfsg-1ubuntu3.1 | [libfreeradius3 3.0.16+dfsg-1ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libfreeradius3-3.0.16-dfsg-1ubuntu3.1.md) | Apr 15, 2019 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.