CVE-2019-11555 — Vulnetix

Try Vulnetix Request Demo

CVE-2019-11555 PUBLISHED

The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.

EPSS 13.90% · 94.2th percentile

Risk Scores

EPSS Score

13.90%

94.2th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:16.04:LTS	wpa	0, 2.4-0ubuntu3, 2.4-0ubuntu4
Ubuntu:Pro:14.04:LTS	wpa	2.1-0ubuntu1.7, 2.1-0ubuntu1, 2.1-0ubuntu1.1
Ubuntu:18.04:LTS	wpa	2.4-0ubuntu10, 2:2.4-1.1ubuntu1, 2:2.6-15ubuntu1

Timeline

Apr 26, 2019 CVE Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Dec 25, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Feb 25, 2022 EPSS Score
Apr 28, 2022 EPSS Score
Jun 29, 2022 EPSS Score
Nov 1, 2022 EPSS Score
Jan 2, 2023 EPSS Score
Mar 7, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2019-11555 third-party-advisory
https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt third-party-advisory
http://www.openwall.com/lists/oss-security/2019/04/26/1 third-party-advisory
https://www.openwall.com/lists/oss-security/2019/04/18/6 third-party-advisory
https://ubuntu.com/security/notices/USN-3969-1 vendor-advisory
https://ubuntu.com/security/notices/USN-3969-2 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2019-11555 third-party-advisory

Open in Interactive Console →