MGASA-2019-0229 - Updated wpa_supplicant and hostapd packages fix security vulnerability

Publication date: 31 Aug 2019
URL: https://advisories.mageia.org/MGASA-2019-0229.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-9494

A number of potential side channel attacks were discovered in the SAE
implementations used by both hostapd (AP) and wpa_supplicant
(infrastructure BSS station/mesh station). SAE (Simultaneous
Authentication of Equals) is also known as WPA3-Personal. The discovered
side channel attacks may be able to leak information about the used
password based on observable timing differences and cache access
patterns. This might result in full password recovery when combined with
an offline dictionary attack and if the password is not strong enough to
protect against dictionary attacks.

References:
- https://bugs.mageia.org/show_bug.cgi?id=25258
- https://w1.fi/security/2019-1/sae-side-channel-attacks.txt
- https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9494

SRPMS:
- 7/core/wpa_supplicant-2.9-1.1.mga7
- 7/core/hostapd-2.9-1.mga7