The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade wpa_supplicantUpgrade hostapd | Jun 21, 2019 | Apr 26, 2019 |
| Debian | — | Upgrade wpa | May 27, 2019 | Apr 26, 2019 |
| Gentoo Linux | — | Upgrade net-wireless/wpa_supplicant.Upgrade net-wireless/hostapd. | Aug 19, 2019 | Apr 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wpa_supplicant | Jan 3, 2020 | Apr 26, 2019 |
| Suse | — | Upgrade wpa_supplicant-guiUpgrade wpa_supplicant | Nov 20, 2020 | Apr 26, 2019 |
| Ubuntu | — | Upgrade wpasupplicant (Ubuntu Pro)Upgrade hostapdUpgrade hostapd (Ubuntu Pro)Upgrade wpasupplicant | May 8, 2019 | Apr 26, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 26, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub