CVE-2019-9494
Published: 10 April 2019
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
Priority
Medium
CVSS 3 base score: 5.9
Status
| Package | Release | Status |
|---|---|---|
|
wpa Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not built)
|
| cosmic |
Not vulnerable
(code not built)
|
|
| precise |
Does not exist
|
|
| trusty |
Not vulnerable
(code not built)
|
|
| upstream |
Released
(2.8)
|
|
| xenial |
Not vulnerable
(code not built)
|
|
|
wpasupplicant Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| precise |
Not vulnerable
(code not built)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
Notes
| Author | Note |
|---|---|
| mdeslaur | SAE support not built in Ubuntu |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9494
- https://w1.fi/security/2019-1/
- NVD
- Launchpad
- Debian