CVE-2019-9498
Summary
| CVE | CVE-2019-9498 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-04-17 14:29:00 UTC |
|---|
| Updated | 2023-11-07 03:13:00 UTC |
|---|
| Description | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 28 Update: hostapd-2.7-2.fc28 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 29 Update: hostapd-2.7-2.fc29 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [security-announce] openSUSE-SU-2020:0222-1: moderate: Security update f |
SUSE |
lists.opensuse.org |
Mailing List, Third Party Advisory |
| Synology Inc. |
CONFIRM |
www.synology.com |
Third Party Advisory |
| [SECURITY] Fedora 30 Update: hostapd-2.7-2.fc30 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Release Notes, Third Party Advisory |
| [SECURITY] [DLA 1867-1] wpa security update |
MLIST |
lists.debian.org |
Mailing List, Third Party Advisory |
| [SECURITY] Fedora 29 Update: hostapd-2.7-2.fc29 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Release Notes, Third Party Advisory |
| [SECURITY] Fedora 30 Update: hostapd-2.7-2.fc30 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Index of /security/2019-4 |
CONFIRM |
w1.fi |
Patch, Vendor Advisory |
| Bugtraq: FreeBSD Security Advisory FreeBSD-SA-19:03.wpa |
BUGTRAQ |
seclists.org |
Mailing List, Third Party Advisory |
| FreeBSD-SA-19:03 |
FREEBSD |
security.FreeBSD.org |
Third Party Advisory |
| [SECURITY] Fedora 28 Update: hostapd-2.7-2.fc28 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Release Notes, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500741 Alpine Linux Security Update for wpa_supplicant
- 504517 Alpine Linux Security Update for wpa_supplicant
- 750549 OpenSUSE Security Update for wpa_supplicant (openSUSE-SU-2020:2059-1)
- 750557 OpenSUSE Security Update for wpa_supplicant (openSUSE-SU-2020:2053-1)
- 752179 SUSE Enterprise Linux Security Update for wpa_supplicant (SUSE-SU-2022:1853-1)
