wpa_supplicant (SUSE:OpenStack Cloud 8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:OpenStack Cloud 8 package wpa_supplicant, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (23)

• CVE-2022-23304 — CVSS 9.8 (critical): The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of…
• CVE-2022-23303 — CVSS 9.8 (critical): The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of…
• CVE-2019-9497 — CVSS 8.1 (high): The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in…
• CVE-2017-13082 — CVSS 8.1 (high): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key…
• CVE-2019-9499 — CVSS 8.1 (high): The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported…
• CVE-2019-9498 — CVSS 8.1 (high): The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements…
• CVE-2021-27803 — CVSS 7.5 (high): A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests…
• CVE-2021-0326 — CVSS 7.5 (high): In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code…
• CVE-2017-13077 — CVSS 6.8 (medium): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way…
• CVE-2017-13086 — CVSS 6.8 (medium): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS…
• CVE-2018-14526 — CVSS 6.5 (medium): An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages…
• CVE-2019-16275 — CVSS 6.5 (medium): hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source…
• CVE-2019-11555 — CVSS 5.9 (medium): The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation…
• CVE-2019-13377 — CVSS 5.9 (medium): The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of…
• CVE-2019-9494 — CVSS 5.9 (medium): The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing…
• CVE-2017-13078 — CVSS 5.3 (medium): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an…
• CVE-2017-13080 — CVSS 5.3 (medium): Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an…
• CVE-2017-13079 — CVSS 5.3 (medium): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during…
• CVE-2017-13088 — CVSS 5.3 (medium): Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing…
• CVE-2017-13087 — CVSS 5.3 (medium): Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless…
• CVE-2017-13081 — CVSS 5.3 (medium): Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during…
• CVE-2015-8041 — CVSS 5.0 (medium): Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a…
• CVE-2019-9495 — CVSS 3.7 (low): The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns…