Bug 23781 - hostapd new security issue CVE-2018-14526
Summary: hostapd new security issue CVE-2018-14526
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Thomas Backlund
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-10-29 02:39 CET by David Walser
Modified: 2019-11-06 13:44 CET (History)
4 users (show)

See Also:
Source RPM: hostapd-2.6-4.mga7.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2018-10-29 02:39:17 CET 
+++ This bug was initially created as a clone of Bug #23412 +++

Upstream has issued an advisory today (August 8):
https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt

Patches are available in the same directory and it will be fixed in 2.7.

Mageia 6 is also affected.

We fixed this for wpa_supplicant, but hostapd is apparently affected too.

openSUSE has issued an advisory for this on October 27:
https://lists.opensuse.org/opensuse-updates/2018-10/msg00222.html
David Walser 2018-10-29 02:39:30 CET

Whiteboard: (none) => MGA6TOO

Comment 1 Marja Van Waes 2018-10-29 08:41:55 CET 
Assigning to the registered maintainer.

Assignee: bugsquad => tmb
CC: (none) => marja11

Comment 2 David Walser 2019-01-01 01:46:35 CET 
I updated it to 2.7 in Cauldron.

Whiteboard: MGA6TOO => (none)
Version: Cauldron => 6

Comment 3 Mike Rambo 2019-11-06 13:44:19 CET 
Mageia 6 is EOL.

Resolution: (none) => OLD
CC: (none) => mrambo
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.