vulnerability

FreeBSD: VID-98b71436-656d-11e9-8e67-206a8a720317 (CVE-2019-9496): FreeBSD -- SAE confirm missing state validation

Try Surface Command
Back to search
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Published
Apr 23, 2019
Added
Apr 23, 2019
Modified
Dec 10, 2025

Description

Problem Description: When hostapd is used to operate an access point with SAE (Simultaneous Authentication of Equals; also known as WPA3-Personal), an invalid authentication sequence could result in the hostapd process terminating due to a NULL pointer dereference when processing SAE confirm message. This was caused by missing state validation steps when processing the SAE confirm message in hostapd/AP mode. See https://w1.fi/security/2019-3/sae-confirm-missing-state-validation.txt for a detailed description of the bug. Impact: All hostapd versions with SAE support (CONFIG_SAE=y in the build configuration and SAE being enabled in the runtime configuration).

Solutions

freebsd-upgrade-base-12_0-release-p3freebsd-upgrade-base-11_2-release-p9freebsd-upgrade-package-wpa_supplicantfreebsd-upgrade-package-hostapd

References

Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today