CVE-2019-9494
Published: 10 April 2019
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
Priority
CVSS 3 base score: 5.9
Status
Package | Release | Status |
---|---|---|
wpa Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not built)
|
cosmic |
Not vulnerable
(code not built)
|
|
precise |
Does not exist
|
|
trusty |
Not vulnerable
(code not built)
|
|
upstream |
Released
(2.8)
|
|
xenial |
Not vulnerable
(code not built)
|
|
wpasupplicant Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
cosmic |
Does not exist
|
|
precise |
Not vulnerable
(code not built)
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
Notes
Author | Note |
---|---|
mdeslaur | SAE support not built in Ubuntu |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9494
- https://w1.fi/security/2019-1/
- NVD
- Launchpad
- Debian