Advisories » MGASA-2019-0229

Updated wpa_supplicant and hostapd packages fix security vulnerability

Publication date: 31 Aug 2019
Modification date: 31 Aug 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-9494 , CVE-2019-13377

Description

A number of potential side channel attacks were discovered in the SAE
implementations used by both hostapd (AP) and wpa_supplicant
(infrastructure BSS station/mesh station). SAE (Simultaneous
Authentication of Equals) is also known as WPA3-Personal. The discovered
side channel attacks may be able to leak information about the used
password based on observable timing differences and cache access
patterns. This might result in full password recovery when combined with
an offline dictionary attack and if the password is not strong enough to
protect against dictionary attacks.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=25258
• https://w1.fi/security/2019-1/sae-side-channel-attacks.txt
• https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9494
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13377

SRPMS

7/core

• wpa_supplicant-2.9-1.1.mga7
• hostapd-2.9-1.mga7