Read the docs
TI-2021-12310 Aliases CVE-2021-32642

Missing input validation in dynamic discovery example scripts.

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `naptr-eduroam.sh` and `radsec-dynsrv.sh` scripts can lead to configuration injection via crafted radsec peer discovery DNS records. Users are subject to Information disclosure, Denial of Service, Redirection of Radius connection to a non-authenticated server leading to non-authenticated network access. Updated example scripts are available in the master branch and 1.9 release. Note that the scripts are not part of the installation package and are not updated automatically. If you are using the examples, you have to update them manually. The dyndisc scripts work independently of the radsecproxy code. The updated scripts can be used with any version of radsecproxy.

Why it matters now

EPSS 0.01342 71st percentileScored 2026-11-07
Fix Fixed radsecproxy (radsecproxy): 1.9.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
radsecproxyradsecproxybefore 1.9.01.9.0Patch availableCNA
  • radsecproxy Vendorradsecproxy Affected before 1.9.0 Fixed in 1.9.0 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:uninett:radsecproxy:*:*:*:*:*:*:*:*before 1.9.0Vulnerableuninett
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
  • cpe:2.3:a:uninett:radsecproxy:*:*:*:*:*:*:*:* Versions before 1.9.0 Vulnerable ·uninett
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA radsecproxy (radsecproxy) Fixed in 1.9.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32642

References

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences