CVE-2019-17185: 
NixOS vulnerability analysis and mitigation

CVE-2019-17185 affects FreeRADIUS versions 3.0.x before 3.0.20, specifically in the EAP-pwd module. The vulnerability was discovered in 2019 and involves a concurrency issue where the module used a global OpenSSL BN_CTX instance to handle all handshakes, leading to potential system crashes (NVD, FreeRADIUS Security).

The vulnerability stems from a design flaw where multiple threads use the same BN_CTX instance concurrently when handling EAP-pwd handshakes. This concurrent access to a shared resource without proper synchronization results in race conditions. The CVSS v3.1 base score is 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can result in crashes when concurrent EAP-pwd handshakes are initiated, effectively creating a Denial-of-Service (DoS) condition. The impact is particularly significant for systems that rely heavily on EAP-pwd authentication (NVD).

The vulnerability was fixed in FreeRADIUS version 3.0.20. Organizations should upgrade to this version or later to address the issue. The fix involves proper handling of BN_CTX instances in the EAP-pwd module (FreeRADIUS Release).