Unscored severity · published Nov 20, 2012
CVE-2012-4523
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the…
–
CVSS
1.8%
EPSS
No
On KEV
Description
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Radsecproxy · Uninett
through 1.6; 1.0; 1.0; 1.0; 1.0; 1.1; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4523
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4523
Vendor Advisory
http://secunia.com/advisories/51251
www.debian.org
http://www.debian.org/security/2012/dsa-2573
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/10/17/7
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/10/31/6
www.securityfocus.com
http://www.securityfocus.com/bid/56105
postlister.uninett.no
https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html
More from Radsecproxy
9.4
CVE-2021-32642
radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports
–
CVE-2012-4566
The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used…