| Package | wpa |
|---|---|
| Version | 2:2.9.0-21+deb11u3~deb10u1 (buster) |
| Related CVEs | CVE-2022-23303 CVE-2022-23304 CVE-2022-37660 |
Multiple vulnerabilities were found in wpa, a set of tools including the widely-used wpasupplicant client for authenticating with WPA and WPA2 wireless networks.
CVE-2022-23303
The implementations of SAE in hostapd
are vulnerable to side channel attacks as a result of
cache access patterns.
CVE-2022-23304
The implementations of EAP-pwd are vulnerable
to side-channel attacks as a result of cache access patterns.
CVE-2022-37660
The PKEX code remains active even after
a successful PKEX association. An attacker that successfully
bootstrapped public keys with another entity using PKEX in
the past, will be able to subvert a future bootstrapping
by passively observing public keys.
For Debian 10 buster, these problems have been fixed in version 2:2.9.0-21+deb11u3~deb10u1.
We recommend that you upgrade your wpa packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.