Mageia alert MGASA-2019-0229 (wpa_supplicant, hostapd)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2019-0229: Updated wpa_supplicant and hostapd packages fix security vulnerability 
Date:
             
 
Sat, 31 Aug 2019 15:23:43 +0200
Message-ID:
             
 
<20190831132343.52D6E9F640@duvel.mageia.org>
MGASA-2019-0229 - Updated wpa_supplicant and hostapd packages fix security vulnerability

Publication date: 31 Aug 2019
URL: https://advisories.mageia.org/MGASA-2019-0229.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-9494

Description:
A number of potential side channel attacks were discovered in the SAE
implementations used by both hostapd (AP) and wpa_supplicant
(infrastructure BSS station/mesh station). SAE (Simultaneous
Authentication of Equals) is also known as WPA3-Personal. The discovered
side channel attacks may be able to leak information about the used
password based on observable timing differences and cache access
patterns. This might result in full password recovery when combined with
an offline dictionary attack and if the password is not strong enough to
protect against dictionary attacks.

References:
- https://bugs.mageia.org/show_bug.cgi?id=25258
- https://w1.fi/security/2019-1/sae-side-channel-attacks.txt
- https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-at...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9494

SRPMS:
- 7/core/wpa_supplicant-2.9-1.1.mga7
- 7/core/hostapd-2.9-1.mga7