First published: Wed Apr 17 2019(Updated: )
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
Credit: cret@cert.org
Affected Software | Affected Version | How to fix |
---|---|---|
W1.fi Hostapd | <=2.7 | |
W1.fi Wpa Supplicant | <=2.7 | |
Fedoraproject Fedora | =28 | |
Fedoraproject Fedora | =29 | |
Fedoraproject Fedora | =30 | |
openSUSE Backports SLE | =15.0 | |
openSUSE Backports SLE | =15.0-sp1 | |
openSUSE Leap | =15.1 | |
Synology Radius Server | =3.0 | |
Synology Router Manager | <1.2.3-8087 | |
FreeBSD FreeBSD | =11.2 | |
FreeBSD FreeBSD | =11.2-p2 | |
FreeBSD FreeBSD | =11.2-p3 | |
FreeBSD FreeBSD | =11.2-p4 | |
FreeBSD FreeBSD | =11.2-p5 | |
FreeBSD FreeBSD | =11.2-p6 | |
FreeBSD FreeBSD | =11.2-p7 | |
FreeBSD FreeBSD | =11.2-p8 | |
FreeBSD FreeBSD | =11.2-p9 | |
FreeBSD FreeBSD | =11.2-rc3 | |
FreeBSD FreeBSD | =12.0 | |
FreeBSD FreeBSD | =12.0-p1 | |
FreeBSD FreeBSD | =12.0-p2 | |
FreeBSD FreeBSD | =12.0-p3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2019-9494 is a vulnerability in the implementations of SAE in hostapd and wpa_supplicant, which are vulnerable to side channel attacks.
The severity of CVE-2019-9494 is medium with a CVSS score of 5.9.
The affected software includes W1.fi Hostapd, W1.fi Wpa Supplicant, Fedoraproject Fedora, openSUSE Backports SLE, openSUSE Leap, Synology Radius Server, Synology Router Manager, and Freebsd Freebsd.
An attacker can exploit CVE-2019-9494 by gaining leaked information from a side channel attack that can be used for full password recovery.
Yes, you can find references for CVE-2019-9494 at the following links: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html, http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html, and https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/.