CVE-2019-11235: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Affected products

• Canonical Ubuntu Linux: version 18.04 only; version 18.10 only; version 19.04 only
• Fedoraproject Fedora: affected versions not specified
• Freeradius Freeradius: before 3.0.19 (fixed in 3.0.19)
• Opensuse Leap: version 15.0 only
• Red Hat Enterprise Linux: version 7.0 only
• Red Hat Enterprise Linux Eus: version 7.6 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only
• Red Hat Enterprise Linux Workstation: version 7.0 only

Published 2019-04-22. Last modified 2026-06-17.