rlm_eap/types/rlm_eap_pwd/eap_pwd.c in the EAP-pwd implementation in FreeRADIUS before 3.0.20 allows remote attackers to discover passwords because there is a side-channel information leak associated with the Hunting and Pecking abort for excessive iterations. CREATE(Triage):(User=admin) CVE-2019-20510 (https://nvd.nist.gov/vuln/detail/CVE-2019-20510)
