UbuntuUpdates.org

Package "wpasupplicant"

Name: wpasupplicant

Description:

client support for WPA and WPA2 (IEEE 802.11i)
Latest version: 2.4-0ubuntu6.8+esm1
Release: xenial (16.04)
Level: security
Repository: main
Head package: wpa
Homepage: http://w1.fi/wpa_supplicant/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "wpasupplicant"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "wpasupplicant" in Xenial

Repository Area Version
base main 2.4-0ubuntu6
updates main 2.4-0ubuntu6.8+esm1

Changelog

Version: 2.4-0ubuntu6.4 2019-04-10 18:07:19 UTC

  wpa (2.4-0ubuntu6.4) xenial-security; urgency=medium

  * SECURITY UPDATE: Multiple security issues
    - debian/patches/VU-871675/*.patch: backported upstream patches.
    - CVE-2019-9495
    - CVE-2019-9497
    - CVE-2019-9498
    - CVE-2019-9499
  * SECURITY UPDATE: insecure os_random() fallback
    - debian/patches/CVE-2016-10743.patch: Use only os_get_random() for PIN
      generation.
    - CVE-2016-10743

 -- Marc Deslauriers <email address hidden> Tue, 09 Apr 2019 07:29:43 -0400
Source diff to previous version
CVE-2019-9495 cache attack against EAP-pwd
CVE-2019-9497 EAP-pwd server not checking for reflection attack
CVE-2019-9498 EAP-pwd server missing commit validation for scalar/element
CVE-2019-9499 EAP-pwd peer missing commit validation for scalar/element
CVE-2016-10743 hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.

Version: 2.4-0ubuntu6.3 2018-08-22 19:06:52 UTC

  wpa (2.4-0ubuntu6.3) xenial-security; urgency=medium

  * SECURITY UPDATE: Expose sensitive information
    - debian/patches/CVE-2018-14526.patch: fix in src/rsn_supp/wpa.c.
    - CVE-2018-14526

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 09 Aug 2018 12:51:53 -0300
Source diff to previous version
CVE-2018-14526 An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not che

Version: 2.4-0ubuntu6.2 2017-10-16 17:06:50 UTC

  wpa (2.4-0ubuntu6.2) xenial-security; urgency=medium

  * SECURITY UPDATE: Multiple issues in WPA protocol
    - debian/patches/2017-1/*.patch: Add patches from Debian stretch
    - CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080,
      CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087,
      CVE-2017-13088
  * SECURITY UPDATE: Denial of service issues
    - debian/patches/2016-1/*.patch: Add patches from Debian stretch
    - CVE-2016-4476
    - CVE-2016-4477
  * This package does _not_ contain the changes from 2.4-0ubuntu6.1 in
    xenial-proposed.

 -- Marc Deslauriers <email address hidden> Mon, 16 Oct 2017 07:58:48 -0400
CVE-2017-1307 RESERVED
CVE-2017-1308 IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have acces
CVE-2016-4476 hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attac
CVE-2016-4477 wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library


About   -   Send Feedback to @ubuntu_updates