CVE-2019-9494
Published: 10 April 2019
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
Priority
Medium
CVSS 3 base score: 5.9
Status
| Package | Release | Status |
|---|---|---|
|
wpa Launchpad, Ubuntu, Debian |
Upstream |
Released
(2.8)
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Not vulnerable
(code not built)
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Not vulnerable
(code not built)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Not vulnerable
(code not built)
|
|
| Ubuntu 12.04 ESM (Precise Pangolin) |
Does not exist
|
|
|
wpasupplicant Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
| Ubuntu 12.04 ESM (Precise Pangolin) |
Not vulnerable
(code not built)
|