CVE-2019-9497

Name	CVE-2019-9497
Description	The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1867-1, DSA-4430-1
Debian Bugs	926801

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wpa (PTS)	jessie, jessie (lts)	2.3-1+deb8u15	fixed
	stretch (security)	2:2.4-1+deb9u9	fixed
	stretch (lts), stretch	2:2.4-1+deb9u11	fixed
	buster, buster (lts)	2:2.7+git20190128+0c1e29f-6+deb10u5	fixed
	buster (security)	2:2.7+git20190128+0c1e29f-6+deb10u4	fixed
	bullseye (security), bullseye	2:2.9.0-21+deb11u2	fixed
	bookworm (security), bookworm	2:2.10-12+deb12u2	fixed
	sid, trixie	2:2.10-22	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
wpa	source	wheezy	(unfixed)	end-of-life
wpa	source	jessie	2.3-1+deb8u8		DLA-1867-1
wpa	source	stretch	2:2.4-1+deb9u3		DSA-4430-1
wpa	source	(unstable)	2:2.7+git20190128+0c1e29f-4			926801

https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt
Patches: https://w1.fi/security/2019-4/