• [SECURITY] [DSA 4450-1] wpa security update

    From Yves-Alexis Perez@1:229/2 to All on Fri May 24 16:40:02 2019
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-4450-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez
    May 24, 2019 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : wpa
    CVE ID : CVE-2019-11555
    Debian Bug : 927463

    A vulnerability was found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point).

    The EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant (EAP peer) doesn't properly validate fragmentation reassembly state when receiving an unexpected fragment. This could lead to a process crash due to a NULL pointer derefrence.

    An attacker in radio range of a station or access point with EAP-pwd support could cause a crash of the relevant process (wpa_supplicant or hostapd), ensuring a denial of service.

    For the stable distribution (stretch), this problem has been fixed in
    version 2:2.4-1+deb9u4.

    We recommend that you upgrade your wpa packages.

    For the detailed security status of wpa please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/wpa

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----

    iQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAlzn/TEACgkQ3rYcyPpX RFspSAf/YMVZvCbELRqK4sZ42zqtP5UCpTx2usFHGakULukrdYOv4Jh9uHjME/VX WAzY9sNIBGIlTpCW/P3qnIbwQaZLcVlZ9fF4JrepuArBC+Cr8Q3sYmUVoiPUTvTv Sm9nj0M3A9yDukRSw8gPWPSjk8z1r4J2LMnCwyxNxug3Iqphr7CMdhTvOzowaEk6 hP18tVx4MHhemzag5zKCo7pLCuVxWyJYL9ndEpFuSl1si7EDUIeWkX9gWeLouIAN zfExE2zUwfgdAzPdH3k4JvYABn7azTp1NgMSlzTTtT9r4yUkg80ilHi5mpeV0oLj 5G4VKNeNRoBOPjNOmOIa1tq6C2rS7g==
    =hAb9
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)