UBUNTU-CVE-2022-23304

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.

References

Affected packages

Ubuntu:20.04:LTS / wpa

Package

Name: wpa
Purl: pkg:deb/ubuntu/wpa@2:2.9-1ubuntu4.6?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2:2.9-1ubuntu4.6

Affected versions

2:2.*

2:2.9-1ubuntu2

2:2.9-1ubuntu3

2:2.9-1ubuntu4

2:2.9-1ubuntu4.1

2:2.9-1ubuntu4.2

2:2.9-1ubuntu4.3

2:2.9-1ubuntu4.4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "hostapd",
            "binary_version": "2:2.9-1ubuntu4.6"
        },
        {
            "binary_name": "hostapd-dbgsym",
            "binary_version": "2:2.9-1ubuntu4.6"
        },
        {
            "binary_name": "wpagui",
            "binary_version": "2:2.9-1ubuntu4.6"
        },
        {
            "binary_name": "wpagui-dbgsym",
            "binary_version": "2:2.9-1ubuntu4.6"
        },
        {
            "binary_name": "wpasupplicant",
            "binary_version": "2:2.9-1ubuntu4.6"
        },
        {
            "binary_name": "wpasupplicant-dbgsym",
            "binary_version": "2:2.9-1ubuntu4.6"
        },
        {
            "binary_name": "wpasupplicant-udeb",
            "binary_version": "2:2.9-1ubuntu4.6"
        }
    ],
    "availability": "No subscription required"
}