[ubuntu/bionic-security] wpa 2:2.6-15ubuntu2.4 (Accepted)

Marc Deslauriers marc.deslauriers at canonical.com
Wed Aug 14 12:48:04 UTC 2019


wpa (2:2.6-15ubuntu2.4) bionic-security; urgency=medium

  * SECURITY UPDATE: SAE/EAP-pwd side-channel attack w/Brainpool curves
    - debian/patches/CVE-2019-13377-2.patch: use const_time_memcmp() for
      pwd_value >= prime comparison in src/eap_common/eap_pwd_common.c.
    - debian/patches/CVE-2019-13377-3.patch: use BN_bn2binpad() or
      BN_bn2bin_padded() if available in src/crypto/crypto_openssl.c.
    - debian/patches/CVE-2019-13377-5.patch: run through prf result
      processing even if it >= prime in src/eap_common/eap_pwd_common.c.
    - debian/patches/CVE-2019-13377-pre6.patch: disallow ECC groups with a
      prime under 256 bits in src/eap_common/eap_pwd_common.c.
    - debian/patches/CVE-2019-13377-6.patch: disable use of groups using
      Brainpool curves in src/eap_common/eap_pwd_common.c.
    - CVE-2019-13377

Date: 2019-08-13 18:50:19.420486+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/wpa/2:2.6-15ubuntu2.4
-------------- next part --------------
Sorry, changesfile not available.


More information about the Bionic-changes mailing list