Read the docs
TI-2024-03351 Aliases CVE-2024-3596GHSA-3g8x-wqfp-q876

RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

Priority MEDIUM 57CWE-354Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 31 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.14859 96th percentileScored 2026-11-07
Fix Partial Red Hat: 20 advisoriesRed Hat: 31 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IETFRFC2865—No fix listedCNA
  • RFC VendorIETF Affected 2865 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*before 3.0.27Vulnerablefreeradius
cpe:2.3:a:broadcom:brocade_sannav:-:*:*:*:*:*:*:*not specified by NVDVulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*not specified by NVDVulnerableBroadcom
cpe:2.3:o:sonicwall:sonicos:-:*:*:*:*:*:*:*not specified by NVDVulnerableSonicWall
  • cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:* Versions before 3.0.27 Vulnerable ·freeradius
  • cpe:2.3:a:broadcom:brocade_sannav:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom
  • cpe:2.3:o:sonicwall:sonicos:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·SonicWall

Remediation

Red Hat 20 advisories

  • RHSA-2024:10852 Released 2024-12-05 · Red Hat rating Important
    RHOAI 2.16.0 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8 +4
  • RHSA-2024:9547 Released 2024-11-13 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) krb5-devel-1.21.1-2.el9_4.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) krb5-1.21.1-2.el9_4.1, krb5-libs-1.21.1-2.el9_4.1, krb5-pkinit-1.21.1-2.el9_4.1 +4
  • RHSA-2024:9474 Released 2024-11-12 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream (v. 9) krb5-devel-1.21.1-4.el9_5
    • Red Hat Enterprise Linux BaseOS (v. 9) krb5-1.21.1-4.el9_5, krb5-libs-1.21.1-4.el9_5, krb5-pkinit-1.21.1-4.el9_5 +4
Show 17 more Red Hat advisories
  • RHSA-2024:8860 Released 2024-11-05 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) krb5-1.18.2-30.el8_10, krb5-devel-1.18.2-30.el8_10, krb5-libs-1.18.2-30.el8_10 +5
  • RHSA-2024:8792 Released 2024-11-04 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) krb5-1.18.2-26.el8_8.3, krb5-devel-1.18.2-26.el8_8.3, krb5-libs-1.18.2-26.el8_8.3 +5
  • RHSA-2024:8794 Released 2024-11-04 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) krb5-1.18.2-16.el8_6.2, krb5-devel-1.18.2-16.el8_6.2, krb5-libs-1.18.2-16.el8_6.2 +5
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) krb5-1.18.2-16.el8_6.2, krb5-devel-1.18.2-16.el8_6.2, krb5-libs-1.18.2-16.el8_6.2 +5
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) krb5-1.18.2-16.el8_6.2, krb5-devel-1.18.2-16.el8_6.2, krb5-libs-1.18.2-16.el8_6.2 +5
  • RHSA-2024:8788 Released 2024-11-04 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) krb5-1.15.1-55.el7_9.3, krb5-devel-1.15.1-55.el7_9.3, krb5-devel-1.15.1-55.el7_9.3.ppc +8
  • RHSA-2024:8791 Released 2024-11-04 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) krb5-1.18.2-9.el8_4.2, krb5-devel-1.18.2-9.el8_4.2, krb5-libs-1.18.2-9.el8_4.2 +5
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) krb5-1.18.2-9.el8_4.2, krb5-devel-1.18.2-9.el8_4.2, krb5-libs-1.18.2-9.el8_4.2 +5
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) krb5-1.18.2-9.el8_4.2, krb5-devel-1.18.2-9.el8_4.2, krb5-libs-1.18.2-9.el8_4.2 +5
  • RHSA-2024:8789 Released 2024-11-04 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) krb5-1.17-19.el8_2.2, krb5-devel-1.17-19.el8_2.2, krb5-libs-1.17-19.el8_2.2 +5
  • RHSA-2024:8577 Released 2024-10-29 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) krb5-devel-1.19.1-16.el9_0.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) krb5-1.19.1-16.el9_0.2, krb5-libs-1.19.1-16.el9_0.2, krb5-pkinit-1.19.1-16.el9_0.2 +4
  • RHSA-2024:8461 Released 2024-10-24 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) krb5-devel-1.20.1-9.el9_2.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) krb5-1.20.1-9.el9_2.2, krb5-libs-1.20.1-9.el9_2.2, krb5-pkinit-1.20.1-9.el9_2.2 +4
  • RHSA-2024:4935 Released 2024-07-31 · Red Hat rating Important
    freeradius security update
    • Red Hat Enterprise Linux AppStream (v. 9) freeradius-3.0.21-40.el9_4, freeradius-devel-3.0.21-40.el9_4, freeradius-doc-3.0.21-40.el9_4 +4
    • Red Hat Enterprise Linux CRB (v. 9) freeradius-mysql-3.0.21-40.el9_4, freeradius-perl-3.0.21-40.el9_4, freeradius-postgresql-3.0.21-40.el9_4 +3
  • RHSA-2024:4936 Released 2024-07-31 · Red Hat rating Important
    freeradius:3.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) freeradius-3.0.20-15.module+el8.10.0+22065+aa3d48ca.aarch64::freeradius:3.0, freeradius-3.0.20-15.module+el8.10.0+22065+aa3d48ca.ppc64le::freeradius:3.0, freeradius-3.0.20-15.module+el8.10.0+22065+aa3d48ca.s390x::freeradius:3.0 +47
  • RHSA-2024:4911 Released 2024-07-30 · Red Hat rating Important
    freeradius security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) freeradius-3.0.20-1.el7_9.1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) freeradius-devel-3.0.20-1.el7_9.1, freeradius-devel-3.0.20-1.el7_9.1.ppc, freeradius-doc-3.0.20-1.el7_9.1 +9
  • RHSA-2024:4912 Released 2024-07-30 · Red Hat rating Important
    freeradius security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) freeradius-3.0.21-26.el9_0.1, freeradius-devel-3.0.21-26.el9_0.1, freeradius-doc-3.0.21-26.el9_0.1 +4
  • RHSA-2024:4913 Released 2024-07-30 · Red Hat rating Important
    freeradius:3.0 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) freeradius-3.0.20-1.module+el8.2.0+22148+b45f7ef2.1.src::freeradius:3.0, freeradius-3.0.20-1.module+el8.2.0+22148+b45f7ef2.1.x86_64::freeradius:3.0, freeradius-devel-3.0.20-1.module+el8.2.0+22148+b45f7ef2.1.x86_64::freeradius:3.0 +10
  • RHSA-2024:4874 Released 2024-07-25 · Red Hat rating Important
    freeradius:3.0 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) freeradius-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.src::freeradius:3.0, freeradius-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.x86_64::freeradius:3.0, freeradius-devel-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.x86_64::freeradius:3.0 +11
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) freeradius-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.ppc64le::freeradius:3.0, freeradius-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.src::freeradius:3.0, freeradius-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.x86_64::freeradius:3.0 +24
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) freeradius-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.src::freeradius:3.0, freeradius-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.x86_64::freeradius:3.0, freeradius-devel-3.0.20-4.module+el8.4.0+22088+2692c5cc.1.x86_64::freeradius:3.0 +11
  • RHSA-2024:4829 Released 2024-07-24 · Red Hat rating Important
    freeradius:3.0 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) freeradius-3.0.20-14.module+el8.8.0+22090+a01d0e6a.1.aarch64::freeradius:3.0, freeradius-3.0.20-14.module+el8.8.0+22090+a01d0e6a.1.ppc64le::freeradius:3.0, freeradius-3.0.20-14.module+el8.8.0+22090+a01d0e6a.1.s390x::freeradius:3.0 +47
  • RHSA-2024:4826 Released 2024-07-24 · Red Hat rating Important
    freeradius:3.0 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) freeradius-3.0.20-12.module+el8.6.0+22086+569c8c49.1.src::freeradius:3.0, freeradius-3.0.20-12.module+el8.6.0+22086+569c8c49.1.x86_64::freeradius:3.0, freeradius-devel-3.0.20-12.module+el8.6.0+22086+569c8c49.1.x86_64::freeradius:3.0 +11
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) freeradius-3.0.20-12.module+el8.6.0+22086+569c8c49.1.aarch64::freeradius:3.0, freeradius-3.0.20-12.module+el8.6.0+22086+569c8c49.1.ppc64le::freeradius:3.0, freeradius-3.0.20-12.module+el8.6.0+22086+569c8c49.1.s390x::freeradius:3.0 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) freeradius-3.0.20-12.module+el8.6.0+22086+569c8c49.1.src::freeradius:3.0, freeradius-3.0.20-12.module+el8.6.0+22086+569c8c49.1.x86_64::freeradius:3.0, freeradius-devel-3.0.20-12.module+el8.6.0+22086+569c8c49.1.x86_64::freeradius:3.0 +11
  • RHSA-2024:4828 Released 2024-07-24 · Red Hat rating Important
    freeradius security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) freeradius-mysql-3.0.21-38.el9_2.2, freeradius-perl-3.0.21-38.el9_2.2, freeradius-postgresql-3.0.21-38.el9_2.2 +3
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) freeradius-3.0.21-38.el9_2.2, freeradius-devel-3.0.21-38.el9_2.2, freeradius-doc-3.0.21-38.el9_2.2 +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:4828
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:4936
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:4935, RHSA-2024:9474
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:4913
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:4874
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:4826
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:4874
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:4826
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:4912, RHSA-2024:8577
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:4829
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:4828, RHSA-2024:8461
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2024:9547
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:4874
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:4826
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:8860
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:9474
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2024:8789
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2024:8791
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2024:8794
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2024:8791
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2024:8794
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2024:8577
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:8792
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2024:8461
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2024:9547
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2024:8791
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2024:8794
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:4935
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2024:4911, RHSA-2024:8788
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2024:4911
Red Hat OpenShift AI 2.16Fixed RHSA-2024:10852
Not affected: 1 product
  • Red Hat OpenShift AI 2.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3596
  2. 2026-10-03 Alias added: GHSA-3g8x-wqfp-q876

References

Advisory 6

Other 4

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-13920 The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker… KEVCVSS 3.1HIGH 7.5
  • TI-2004-02631 The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for… CVSS 3.1CRITICAL 9.8
  • TI-2020-08191 IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic CVSS 3.1MEDIUM 5.3
  • TI-2016-08218 An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too… CVSS 3.0HIGH 8.6
  • TI-2007-02160 The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6… CVSS 2.0HIGH 7.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences