RHSA-2017:2911: Important: wpa_supplicant security update
The wpasupplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i / RSN), and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver.<br>Security Fix(es):<br><li> A new exploitation technique called key reinstallation attacks (KRACK) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit these attacks to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by manipulating cryptographic handshakes used by the WPA2 protocol. (CVE-2017-13077, CVE-2017-13078, CVE-2017-13080, CVE-2017-13087)</li> Red Hat would like to thank CERT for reporting these issues. Upstream acknowledges Mathy Vanhoef (University of Leuven) as the original reporter of these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2017:2911?
The severity of RHSA-2017:2911 is considered important.
How do I fix RHSA-2017:2911?
To fix RHSA-2017:2911, you should update the wpa_supplicant package to the latest version provided by your distribution.
What vulnerabilities does RHSA-2017:2911 address?
RHSA-2017:2911 addresses vulnerabilities in the wpa_supplicant that may allow an attacker to bypass authentication.
What versions of wpa_supplicant are affected by RHSA-2017:2911?
RHSA-2017:2911 affects specific versions of the wpa_supplicant package, details of which can be found in the advisory.
Is there a workaround for the vulnerabilities in RHSA-2017:2911?
There are no known specific workarounds for the vulnerabilities in RHSA-2017:2911, so updating is the recommended action.