Patchwire CVEs, their patch status, and feeds to follow them

CVE-2019-11555

Fixed in a distro release EPSS 3%

The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.

Published 2019-04-26 · CVE record · OSV

Products: w1.fi hostapd, w1.fi wpa_supplicant

Distro releases

ReleasePackageFixed in
Alpine 3.10hostapd2.8-r0
Alpine 3.10wpa_supplicant2.7-r3
Alpine 3.11hostapd2.8-r0
Alpine 3.11wpa_supplicant2.7-r3
Alpine 3.12hostapd2.8-r0
Alpine 3.12wpa_supplicant2.7-r3
Alpine 3.13hostapd2.8-r0
Alpine 3.13wpa_supplicant2.7-r3
Alpine 3.14hostapd2.8-r0
Alpine 3.14wpa_supplicant2.7-r3
Alpine 3.15hostapd2.8-r0
Alpine 3.15wpa_supplicant2.7-r3
Alpine 3.16hostapd2.8-r0
Alpine 3.16wpa_supplicant2.7-r3
Alpine 3.17hostapd2.8-r0
Alpine 3.17wpa_supplicant2.7-r3
Alpine 3.18hostapd2.8-r0
Alpine 3.18wpa_supplicant2.7-r3
Alpine 3.19hostapd2.8-r0
Alpine 3.19wpa_supplicant2.7-r3
Alpine 3.20hostapd2.8-r0
Alpine 3.20wpa_supplicant2.7-r3
Alpine 3.21hostapd2.8-r0
Alpine 3.21wpa_supplicant2.7-r3
Alpine 3.22hostapd2.8-r0
Alpine 3.22wpa_supplicant2.7-r3
Alpine 3.23hostapd2.8-r0
Alpine 3.23wpa_supplicant2.7-r3
Alpine 3.24hostapd2.8-r0
Alpine 3.24wpa_supplicant2.7-r3
Alpine 3.7hostapd2.6-r4
Alpine 3.7wpa_supplicant2.6-r10
Alpine 3.8hostapd2.6-r5
Alpine 3.8wpa_supplicant2.6-r15
Alpine 3.9hostapd2.7-r1
Alpine 3.9wpa_supplicant2.7-r3
Debian 12wpa2:2.7+git20190128+0c1e29f-5
Debian 13wpa2:2.7+git20190128+0c1e29f-5
Debian 14wpa2:2.7+git20190128+0c1e29f-5
Debian 8wpa2.3-1+deb8u8
Debian 9wpa2:2.4-1+deb9u4
SUSE HPE Helion OpenStack 8wpa_supplicant2.9-15.22.1
SUSE Linux Enterprise High Performance Computing 15-ESPOSwpa_supplicant2.9-4.20.1
SUSE Linux Enterprise High Performance Computing 15-LTSSwpa_supplicant2.9-4.20.1
SUSE Linux Enterprise Module for Basesystem 15 SP1wpa_supplicant2.9-4.20.1
SUSE Linux Enterprise Module for Basesystem 15 SP2wpa_supplicant2.9-4.20.1
SUSE Linux Enterprise Server 12 SP2-BCLwpa_supplicant2.9-15.22.1
SUSE Linux Enterprise Server 12 SP3-BCLwpa_supplicant2.9-15.22.1
SUSE Linux Enterprise Server 12 SP3-LTSSwpa_supplicant2.9-15.22.1
SUSE Linux Enterprise Server 12 SP4-LTSSwpa_supplicant2.9-15.22.1
SUSE Linux Enterprise Server 12 SP5wpa_supplicant2.9-23.3.1
SUSE Linux Enterprise Server 15-LTSSwpa_supplicant2.9-4.20.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3wpa_supplicant2.9-15.22.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4wpa_supplicant2.9-15.22.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5wpa_supplicant2.9-23.3.1
SUSE Linux Enterprise Server for SAP Applications 15wpa_supplicant2.9-4.20.1
SUSE OpenStack Cloud 8wpa_supplicant2.9-15.22.1
SUSE OpenStack Cloud 9wpa_supplicant2.9-15.22.1
SUSE OpenStack Cloud Crowbar 8wpa_supplicant2.9-15.22.1
SUSE OpenStack Cloud Crowbar 9wpa_supplicant2.9-15.22.1
Ubuntu 16.04 LTSwpa2.4-0ubuntu6.5
Ubuntu 18.04 LTSwpa2:2.6-15ubuntu2.3
Ubuntu Pro 14.04 LTSwpa2.1-0ubuntu1.7+esm1
openSUSE Leap 15.1wpa_supplicant2.9-lp151.5.10.1
openSUSE Leap 15.2wpa_supplicant2.9-lp152.8.3.1
openSUSE Tumbleweedwpa_supplicant2.9-13.4