CVE-2017-9148

An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS session.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable TLS session caching in FreeRADIUS by setting "enable = no" in the cache subsection of EAP module settings, which are in /etc/raddb/mods-available/eap file.