{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Mathy Vanhoef"
        ],
        "organization": "the Katholieke Universiteit Leuven in Belgium",
        "summary": "discovering this vulnerability"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of this vulnerability may allow the attacker to operate as a man-in-the-middle between the device and the wireless network.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing, Energy, Water and Wastewater Systems",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "This vulnerability is exploitable from an adjacent network. High skill level is needed to exploit.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-299-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-299-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-299-02 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-299-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Rockwell Automation Stratix 5100 (Update A)",
    "tracking": {
      "current_release_date": "2018-11-01T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-17-299-02",
      "initial_release_date": "2017-10-26T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2017-10-26T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-17-299-02 Rockwell Automation Stratix 5100"
        },
        {
          "date": "2018-11-01T00:00:00.000000Z",
          "legacy_version": "A",
          "number": "2",
          "summary": "ICSA-17-299-02 Rockwell Automation Stratix 5100 (Update A)"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 15.3(3) JC1",
                "product": {
                  "name": "Stratix 5100: Version 15.3(3) JC1 and earlier",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Stratix 5100"
          }
        ],
        "category": "vendor",
        "name": "Rockwell Automation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-13082",
      "cwe": {
        "id": "CWE-323",
        "name": "Reusing a Nonce, Key Pair in Encryption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Key reinstallation attacks (KRACK) work against the four-way handshake of the WPA2 protocol. KRACK takes advantage of the retransmission of a handshake message to prompt the installation of the same encryption key every time it receives message 3 from the access point. Retransmission of the handshake message from the access point occurs if a proper client acknowledgement is not received to the initial message; retransmission resets the nonce value and replay counter to their initial values. A malicious actor could force these nonce resets by replaying the appropriate handshake message, which could allow for injection and decryption of arbitrary packets, hijacking of TCP connections, injection of HTTP content, or replaying of unicast or multicast data frames on the targeted device.CVE-2017-13082 has been assigned to this vulnerability. A CVSS v3 base score of 6.9 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13082"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Rockwell Automation recommends that all users patch the clients that connect to the Stratix 5100 WAP/WGB, and recommends contacting a supplier to get the most updated compatible patch. However, patching the client only protects the connection formed by that specific client. In order to protect all future clients, Rockwell Automation recommends patching the Stratix 5100 WAP/WGB when the firmware is available.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "After further investigation, Rockwell Automation has determined that since the vulnerability affects Stratix 5100 access points with 802.11r enabled and 802.11r is not fully supported on the Stratix 5100 WAP/WGB, access-point users are not affected by this vulnerability and patching the Stratix 5100 WAP/WGB is not required when the device is operating as an access point. To verify that 802.11r is disabled, please refer to this Knowledgebase Article ID 1068007. Rockwell still suggests that users refer to manufacturers of their connected wireless client devices for suggested patch procedures.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As new versions of firmware are released to remediate this vulnerability, Rockwell Automation will provide mitigation updates in their advisory. For more information about this vulnerability, mitigation updates, and Rockwell Automation\u0027s general security guidelines, please see Rockwell Automation\u0027s security advisory found at the following link. A login is required to view the advisory.https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1066697 Rockwell Automation also offers the following general security guidelines:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use trusted software, software patches, anti-virus/anti-malware programs, and interact only with trusted websites and attachments.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Block all traffic to EtherNet/IP or other CIP protocol-based devices from outside the manufacturing zone by blocking or restricting access to TCP and UDP Port 2222 and Port 44818 using proper network infrastructure controls, such as firewalls, unified threat management (UTM) devices, or other security appliances. For more information on TCP/UDP ports used by Rockwell Automation Products, see Knowledge base Article ID 898270.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Help minimize network exposure for all control system devices and/or systems, and confirm that they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls, and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that a VPN is only as secure as the connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Mathy Vanhoef"
        ],
        "organization": "the Katholieke Universiteit Leuven in Belgium",
        "summary": "discovering these vulnerabilities"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "summary",
        "text": "Mathy Vanhoef, of the Katholieke Universiteit Leuven in Belgium, discovered these vulnerabilities.",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "These vulnerabilities have been publicly disclosed. These vulnerabilities are exploitable from an adjacent network. High skill level is needed to exploit.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "CISAservicedesk@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-318-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-318-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-318-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-318-01"
      }
    ],
    "title": "ICSA-17-318-01_Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update F)",
    "tracking": {
      "current_release_date": "2019-04-09T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA USCert CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-17-318-01",
      "initial_release_date": "2017-11-14T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2017-11-14T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-17-318-01 Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products"
        },
        {
          "date": "2017-12-05T00:00:00.000000Z",
          "legacy_version": "A",
          "number": "2",
          "summary": "ICSA-17-318-01A Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update A)"
        },
        {
          "date": "2017-12-19T00:00:00.000000Z",
          "legacy_version": "B",
          "number": "3",
          "summary": "ICSA-17-318-01B Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update B)"
        },
        {
          "date": "2018-01-25T00:00:00.000000Z",
          "legacy_version": "C",
          "number": "4",
          "summary": "ICSA-17-318-01C Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update C)"
        },
        {
          "date": "2018-04-24T00:00:00.000000Z",
          "legacy_version": "D",
          "number": "5",
          "summary": "ICSA-17-318-01 Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update D)"
        },
        {
          "date": "2018-11-13T00:00:00.000000Z",
          "legacy_version": "E",
          "number": "6",
          "summary": "ICSA-17-318-01 Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update E)"
        },
        {
          "date": "2019-04-09T00:00:00.000000Z",
          "legacy_version": "F",
          "number": "7",
          "summary": "ICSA-17-318-01 Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update F)"
        }
      ],
      "status": "final",
      "version": "7"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 22.3.5.16",
                "product": {
                  "name": "SIMATIC RF650M: All versions with Summit Client Utility prior to v22.3.5.16",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC RF650M"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "SCALANCE W-700 (IEEE 802.11a/b/g): All versions",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE W-700 (IEEE 802.11a/b/g)"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC Mobile Panel 277(F) IWLAN: All versions",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Mobile Panel 277(F) IWLAN"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "RUGGEDCOM RS9xxW: All versions",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM RS9xxW"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 22.3.5.16",
                "product": {
                  "name": "SIMATIC RF350M: All versions with Summit Client Utility prior to v22.3.5.16",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC RF350M"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 01.03.01",
                "product": {
                  "name": "SINAMICS v20 Smart Access Module: All versions prior to v01.03.01",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS v20 Smart Access Module"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 9.21.19.003",
                "product": {
                  "name": "SCALANCE WLC712: All versions prior to v9.21.19.003",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE WLC712"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.1",
                "product": {
                  "name": "SCALANCE W-700 (IEEE 802.11n): All versions prior to v6.2.1",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE W-700 (IEEE 802.11n)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.5.1.5-4.3.1.8",
                "product": {
                  "name": "SCALANCE W1750D: All versions prior to v6.5.1.5-4.3.1.8",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE W1750D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 2.11.2",
                "product": {
                  "name": "RUGGEDCOM RX1400 with WLAN interface: All versions prior to v2.11.2",
                  "product_id": "CSAFPID-00010"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM RX1400 with WLAN interface"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC IWLAN-PB/LINK: All versions",
                  "product_id": "CSAFPID-00011"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IWLAN-PB/LINK"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 9.21.19.003",
                "product": {
                  "name": "SCALANCE WLC711: All versions prior to v9.21.19.003",
                  "product_id": "CSAFPID-00012"
                }
              }
            ],
            "category": "product_name",
            "name": "SCALANCE WLC711"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC ET200 PRO IM154-6 PN IWLAN: All versions",
                  "product_id": "CSAFPID-00013"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET200 PRO IM154-6 PN IWLAN"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-13077",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) allows reinstallation of the pairwise key in the four-way handshake.CVE-2017-13077 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13077"
    },
    {
      "cve": "CVE-2017-13078",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) allows reinstallation of the group temporal key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.CVE-2017-13078 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13078"
    },
    {
      "cve": "CVE-2017-13079",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the integrity group temporal key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.CVE-2017-13079 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13079"
    },
    {
      "cve": "CVE-2017-13080",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) allows reinstallation of the group temporal key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.CVE-2017-13080 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13080"
    },
    {
      "cve": "CVE-2017-13081",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the integrity group temporal key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.CVE-2017-13081 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13081"
    },
    {
      "cve": "CVE-2017-13082",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the pairwise transient key (PTK) temporal key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.CVE-2017-13082 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13082"
    },
    {
      "cve": "CVE-2017-13084",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) allows reinstallation of the station-to-station-link (STSL) transient key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.CVE-2017-13084 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13084"
    },
    {
      "cve": "CVE-2017-13086",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) allows reinstallation of the tunneled direct-link setup (TDLS) peer key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.CVE-2017-13086 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13086"
    },
    {
      "cve": "CVE-2017-13087",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) that support 802.11v allows reinstallation of the group temporal key (GTK) when processing a wireless network management (WNM) sleep mode response frame, allowing an attacker within radio range to replay frames from access points to clients.CVE-2017-13087 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13087"
    },
    {
      "cve": "CVE-2017-13088",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Wi-Fi protected access (WPA and WPA2) that support 802.11v allows reinstallation of the integrity group temporal key (IGTK) when processing a wireless network management (WNM) sleep mode response frame, allowing an attacker within radio range to replay frames from access points to clients.CVE-2017-13088 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Contact the RUGGEDCOM support team at:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013"
          ]
        }
      ],
      "title": "CVE-2017-13088"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for hostapd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for hostapd fixes the following issues:\n\nhostapd was updated to version 2.9:\n\n* SAE changes\n  - disable use of groups using Brainpool curves\n  - improved protection against side channel attacks\n    [https://w1.fi/security/2019-6/]\n* EAP-pwd changes\n  - disable use of groups using Brainpool curves\n  - improved protection against side channel attacks\n  [https://w1.fi/security/2019-6/]\n* fixed FT-EAP initial mobility domain association using PMKSA caching\n* added configuration of airtime policy\n* fixed FILS to and RSNE into (Re)Association Response frames\n* fixed DPP bootstrapping URI parser of channel list\n* added support for regulatory WMM limitation (for ETSI)\n* added support for MACsec Key Agreement using IEEE 802.1X/PSK\n* added experimental support for EAP-TEAP server (RFC 7170)\n* added experimental support for EAP-TLS server with TLS v1.3\n* added support for two server certificates/keys (RSA/ECC)\n* added AKMSuiteSelector into \u0027STA \u003caddr\u003e\u0027 control interface data to\n  determine with AKM was used for an association\n* added eap_sim_id parameter to allow EAP-SIM/AKA server pseudonym and\n  fast reauthentication use to be disabled\n* fixed an ECDH operation corner case with OpenSSL\n\nUpdate to version 2.8\n* SAE changes\n  - added support for SAE Password Identifier\n  - changed default configuration to enable only group 19\n    (i.e., disable groups 20, 21, 25, 26 from default configuration) and\n    disable all unsuitable groups completely based on REVmd changes\n  - improved anti-clogging token mechanism and SAE authentication\n    frame processing during heavy CPU load; this mitigates some issues\n    with potential DoS attacks trying to flood an AP with large number\n    of SAE messages\n  - added Finite Cyclic Group field in status code 77 responses\n  - reject use of unsuitable groups based on new implementation guidance\n    in REVmd (allow only FFC groups with prime \u003e= 3072 bits and ECC\n    groups with prime \u003e= 256)\n  - minimize timing and memory use differences in PWE derivation\n    [https://w1.fi/security/2019-1/] (CVE-2019-9494)\n  - fixed confirm message validation in error cases\n    [https://w1.fi/security/2019-3/] (CVE-2019-9496)\n* EAP-pwd changes\n  - minimize timing and memory use differences in PWE derivation\n    [https://w1.fi/security/2019-2/] (CVE-2019-9495)\n  - verify peer scalar/element\n    [https://w1.fi/security/2019-4/] (CVE-2019-9497 and CVE-2019-9498)\n  - fix message reassembly issue with unexpected fragment\n    [https://w1.fi/security/2019-5/]\n  - enforce rand,mask generation rules more strictly\n  - fix a memory leak in PWE derivation\n  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and\n    27)\n* Hotspot 2.0 changes\n  - added support for release number 3\n  - reject release 2 or newer association without PMF\n* added support for RSN operating channel validation\n  (CONFIG_OCV=y and configuration parameter ocv=1)\n* added Multi-AP protocol support\n* added FTM responder configuration\n* fixed build with LibreSSL\n* added FT/RRB workaround for short Ethernet frame padding\n* fixed KEK2 derivation for FILS+FT\n* added RSSI-based association rejection from OCE\n* extended beacon reporting functionality\n* VLAN changes\n  - allow local VLAN management with remote RADIUS authentication\n  - add WPA/WPA2 passphrase/PSK -based VLAN assignment\n* OpenSSL: allow systemwide policies to be overridden\n* extended PEAP to derive EMSK to enable use with ERP/FILS\n* extended WPS to allow SAE configuration to be added automatically\n  for PSK (wps_cred_add_sae=1)\n* fixed FT and SA Query Action frame with AP-MLME-in-driver cases\n* OWE: allow Diffie-Hellman Parameter element to be included with DPP\n  in preparation for DPP protocol extension\n* RADIUS server: started to accept ERP keyName-NAI as user identity\n  automatically without matching EAP database entry\n* fixed PTK rekeying with FILS and FT\n\nwpa_supplicant:\n* SAE changes\n  - added support for SAE Password Identifier\n  - changed default configuration to enable only groups 19, 20, 21\n    (i.e., disable groups 25 and 26) and disable all unsuitable groups\n    completely based on REVmd changes\n  - do not regenerate PWE unnecessarily when the AP uses the\n    anti-clogging token mechanisms\n  - fixed some association cases where both SAE and FT-SAE were enabled\n    on both the station and the selected AP\n  - started to prefer FT-SAE over SAE AKM if both are enabled\n  - started to prefer FT-SAE over FT-PSK if both are enabled\n  - fixed FT-SAE when SAE PMKSA caching is used\n  - reject use of unsuitable groups based on new implementation guidance\n    in REVmd (allow only FFC groups with prime \u003e= 3072 bits and ECC\n    groups with prime \u003e= 256)\n  - minimize timing and memory use differences in PWE derivation\n    [https://w1.fi/security/2019-1/] (CVE-2019-9494)\n* EAP-pwd changes\n  - minimize timing and memory use differences in PWE derivation\n    [https://w1.fi/security/2019-2/] (CVE-2019-9495)\n  - verify server scalar/element\n    [https://w1.fi/security/2019-4/] (CVE-2019-9499)\n  - fix message reassembly issue with unexpected fragment\n    [https://w1.fi/security/2019-5/]\n  - enforce rand,mask generation rules more strictly\n  - fix a memory leak in PWE derivation\n  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and\n    27)\n* fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y\n* Hotspot 2.0 changes\n  - do not indicate release number that is higher than the one\n    AP supports\n  - added support for release number 3\n  - enable PMF automatically for network profiles created from\n    credentials\n* fixed OWE network profile saving\n* fixed DPP network profile saving\n* added support for RSN operating channel validation\n  (CONFIG_OCV=y and network profile parameter ocv=1)\n* added Multi-AP backhaul STA support\n* fixed build with LibreSSL\n* number of MKA/MACsec fixes and extensions\n* extended domain_match and domain_suffix_match to allow list of values\n* fixed dNSName matching in domain_match and domain_suffix_match when\n  using wolfSSL\n* started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both\n  are enabled\n* extended nl80211 Connect and external authentication to support\n  SAE, FT-SAE, FT-EAP-SHA384\n* fixed KEK2 derivation for FILS+FT\n* extended client_cert file to allow loading of a chain of PEM\n  encoded certificates\n* extended beacon reporting functionality\n* extended D-Bus interface with number of new properties\n* fixed a regression in FT-over-DS with mac80211-based drivers\n* OpenSSL: allow systemwide policies to be overridden\n* extended driver flags indication for separate 802.1X and PSK\n  4-way handshake offload capability\n* added support for random P2P Device/Interface Address use\n* extended PEAP to derive EMSK to enable use with ERP/FILS\n* extended WPS to allow SAE configuration to be added automatically\n  for PSK (wps_cred_add_sae=1)\n* removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)\n* extended domain_match and domain_suffix_match to allow list of values\n* added a RSN workaround for misbehaving PMF APs that advertise\n  IGTK/BIP KeyID using incorrect byte order\n* fixed PTK rekeying with FILS and FT\n\n- Enabled CLI editing and history support.\n\nUpdate to version 2.7\n\n* fixed WPA packet number reuse with replayed messages and key\n  reinstallation\n  [http://w1.fi/security/2017-1/] (CVE-2017-13082) (boo#1056061)\n* added support for FILS (IEEE 802.11ai) shared key authentication\n* added support for OWE (Opportunistic Wireless Encryption, RFC 8110;\n  and transition mode defined by WFA)\n* added support for DPP (Wi-Fi Device Provisioning Protocol)\n* FT:\n  - added local generation of PMK-R0/PMK-R1 for FT-PSK\n    (ft_psk_generate_local=1)\n  - replaced inter-AP protocol with a cleaner design that is more\n    easily extensible; this breaks backward compatibility and requires\n    all APs in the ESS to be updated at the same time to maintain FT\n    functionality\n  - added support for wildcard R0KH/R1KH\n  - replaced r0_key_lifetime (minutes) parameter with\n    ft_r0_key_lifetime (seconds)\n  - fixed wpa_psk_file use for FT-PSK\n  - fixed FT-SAE PMKID matching\n  - added expiration to PMK-R0 and PMK-R1 cache\n  - added IEEE VLAN support (including tagged VLANs)\n  - added support for SHA384 based AKM\n* SAE\n  - fixed some PMKSA caching cases with SAE\n  - added support for configuring SAE password separately of the\n    WPA2 PSK/passphrase\n  - added option to require MFP for SAE associations\n    (sae_require_pmf=1)\n  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection\n    for SAE;\n    note: this is not backwards compatible, i.e., both the AP and\n    station side implementations will need to be update at the same\n    time to maintain interoperability\n  - added support for Password Identifier\n* hostapd_cli: added support for command history and completion\n* added support for requesting beacon report\n* large number of other fixes, cleanup, and extensions\n* added option to configure EAPOL-Key retry limits\n  (wpa_group_update_count and wpa_pairwise_update_count)\n* removed all PeerKey functionality\n* fixed nl80211 AP mode configuration regression with Linux 4.15 and\n  newer\n* added support for using wolfSSL cryptographic library\n* fixed some 20/40 MHz coexistence cases where the BSS could drop to\n  20 MHz even when 40 MHz would be allowed\n* Hotspot 2.0\n  - added support for setting Venue URL ANQP-element (venue_url)\n  - added support for advertising Hotspot 2.0 operator icons\n  - added support for Roaming Consortium Selection element\n  - added support for Terms and Conditions\n  - added support for OSEN connection in a shared RSN BSS\n* added support for using OpenSSL 1.1.1\n* added EAP-pwd server support for salted passwords\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-222",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0222-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:0222-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q7B4Y5BPIVXIPXUAQX744IATOJBYNYP6/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:0222-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q7B4Y5BPIVXIPXUAQX744IATOJBYNYP6/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1056061",
        "url": "https://bugzilla.suse.com/1056061"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13082 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13082/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9494 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9494/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9495 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9495/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9496 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9496/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9497 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9497/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9498 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9498/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9499 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9499/"
      }
    ],
    "title": "Security update for hostapd",
    "tracking": {
      "current_release_date": "2020-02-15T19:10:10Z",
      "generator": {
        "date": "2020-02-15T19:10:10Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:0222-1",
      "initial_release_date": "2020-02-15T19:10:10Z",
      "revision_history": [
        {
          "date": "2020-02-15T19:10:10Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-2.9-bp151.5.3.1.aarch64",
                "product": {
                  "name": "hostapd-2.9-bp151.5.3.1.aarch64",
                  "product_id": "hostapd-2.9-bp151.5.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-2.9-bp151.5.3.1.ppc64le",
                "product": {
                  "name": "hostapd-2.9-bp151.5.3.1.ppc64le",
                  "product_id": "hostapd-2.9-bp151.5.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-2.9-bp151.5.3.1.s390x",
                "product": {
                  "name": "hostapd-2.9-bp151.5.3.1.s390x",
                  "product_id": "hostapd-2.9-bp151.5.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-2.9-bp151.5.3.1.x86_64",
                "product": {
                  "name": "hostapd-2.9-bp151.5.3.1.x86_64",
                  "product_id": "hostapd-2.9-bp151.5.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15",
                "product": {
                  "name": "SUSE Package Hub 15",
                  "product_id": "SUSE Package Hub 15"
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP1",
                "product": {
                  "name": "SUSE Package Hub 15 SP1",
                  "product_id": "SUSE Package Hub 15 SP1"
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.aarch64 as component of SUSE Package Hub 15",
          "product_id": "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.ppc64le as component of SUSE Package Hub 15",
          "product_id": "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.s390x as component of SUSE Package Hub 15",
          "product_id": "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.x86_64 as component of SUSE Package Hub 15",
          "product_id": "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.aarch64 as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.ppc64le as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.s390x as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.x86_64 as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.aarch64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.ppc64le as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.s390x as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-bp151.5.3.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
        },
        "product_reference": "hostapd-2.9-bp151.5.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-13082",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13082"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13082",
          "url": "https://www.suse.com/security/cve/CVE-2017-13082"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:10:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13082"
    },
    {
      "cve": "CVE-2019-9494",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9494"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9494",
          "url": "https://www.suse.com/security/cve/CVE-2019-9494"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131291 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1131291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131868 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1131868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194732 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1194732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:10:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9494"
    },
    {
      "cve": "CVE-2019-9495",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9495"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9495",
          "url": "https://www.suse.com/security/cve/CVE-2019-9495"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131291 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1131291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131870 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1131870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194733 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1194733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:10:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-9495"
    },
    {
      "cve": "CVE-2019-9496",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9496"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9496",
          "url": "https://www.suse.com/security/cve/CVE-2019-9496"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131869 for CVE-2019-9496",
          "url": "https://bugzilla.suse.com/1131869"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:10:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-9496"
    },
    {
      "cve": "CVE-2019-9497",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9497"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9497",
          "url": "https://www.suse.com/security/cve/CVE-2019-9497"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:10:10Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-9497"
    },
    {
      "cve": "CVE-2019-9498",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9498"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9498",
          "url": "https://www.suse.com/security/cve/CVE-2019-9498"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:10:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9498"
    },
    {
      "cve": "CVE-2019-9499",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9499"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
          "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
          "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9499",
          "url": "https://www.suse.com/security/cve/CVE-2019-9499"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1.x86_64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.aarch64",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.ppc64le",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.s390x",
            "SUSE Package Hub 15:hostapd-2.9-bp151.5.3.1.x86_64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.aarch64",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.ppc64le",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.s390x",
            "openSUSE Leap 15.1:hostapd-2.9-bp151.5.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:10:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9499"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for wpa_supplicant",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for wpa_supplicant fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934).\n\nNon-security issues fixed:\n\n- Enable SAE support (jsc#SLE-14992).\n- Limit P2P_DEVICE name to appropriate ifname size.\n- Fix wicked wlan (bsc#1156920)\n- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)\n- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)\n- Fix WLAN config on boot with wicked. (bsc#1166933)\n- Update to 2.9 release:\n   * SAE changes\n     - disable use of groups using Brainpool curves\n     - improved protection against side channel attacks\n     [https://w1.fi/security/2019-6/]\n   * EAP-pwd changes\n     - disable use of groups using Brainpool curves\n     - allow the set of groups to be configured (eap_pwd_groups)\n     - improved protection against side channel attacks\n     [https://w1.fi/security/2019-6/]\n   * fixed FT-EAP initial mobility domain association using PMKSA caching\n     (disabled by default for backwards compatibility; can be enabled\n     with ft_eap_pmksa_caching=1)\n   * fixed a regression in OpenSSL 1.1+ engine loading\n   * added validation of RSNE in (Re)Association Response frames\n   * fixed DPP bootstrapping URI parser of channel list\n   * extended EAP-SIM/AKA fast re-authentication to allow use with FILS\n   * extended ca_cert_blob to support PEM format\n   * improved robustness of P2P Action frame scheduling\n   * added support for EAP-SIM/AKA using anonymous@realm identity\n   * fixed Hotspot 2.0 credential selection based on roaming consortium\n     to ignore credentials without a specific EAP method\n   * added experimental support for EAP-TEAP peer (RFC 7170)\n   * added experimental support for EAP-TLS peer with TLS v1.3\n   * fixed a regression in WMM parameter configuration for a TDLS peer\n   * fixed a regression in operation with drivers that offload 802.1X\n     4-way handshake\n   * fixed an ECDH operation corner case with OpenSSL\n   * SAE changes\n     - added support for SAE Password Identifier\n     - changed default configuration to enable only groups 19, 20, 21\n       (i.e., disable groups 25 and 26) and disable all unsuitable groups\n       completely based on REVmd changes\n     - do not regenerate PWE unnecessarily when the AP uses the\n       anti-clogging token mechanisms\n     - fixed some association cases where both SAE and FT-SAE were enabled\n       on both the station and the selected AP\n     - started to prefer FT-SAE over SAE AKM if both are enabled\n     - started to prefer FT-SAE over FT-PSK if both are enabled\n     - fixed FT-SAE when SAE PMKSA caching is used\n     - reject use of unsuitable groups based on new implementation guidance\n       in REVmd (allow only FFC groups with prime \u003e= 3072 bits and ECC\n       groups with prime \u003e= 256)\n     - minimize timing and memory use differences in PWE derivation\n       [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)\n   * EAP-pwd changes\n     - minimize timing and memory use differences in PWE derivation\n       [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)\n     - verify server scalar/element\n       [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,\n       CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)\n     - fix message reassembly issue with unexpected fragment\n       [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)\n     - enforce rand,mask generation rules more strictly\n     - fix a memory leak in PWE derivation\n     - disallow ECC groups with a prime under 256 bits (groups 25, 26, and\n       27)\n     - SAE/EAP-pwd side-channel attack update\n       [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)\n   * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y\n   * Hotspot 2.0 changes\n     - do not indicate release number that is higher than the one\n       AP supports\n     - added support for release number 3\n     - enable PMF automatically for network profiles created from\n       credentials\n   * fixed OWE network profile saving\n   * fixed DPP network profile saving\n   * added support for RSN operating channel validation\n     (CONFIG_OCV=y and network profile parameter ocv=1)\n   * added Multi-AP backhaul STA support\n   * fixed build with LibreSSL\n   * number of MKA/MACsec fixes and extensions\n   * extended domain_match and domain_suffix_match to allow list of values\n   * fixed dNSName matching in domain_match and domain_suffix_match when\n     using wolfSSL\n   * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both\n     are enabled\n   * extended nl80211 Connect and external authentication to support\n     SAE, FT-SAE, FT-EAP-SHA384\n   * fixed KEK2 derivation for FILS+FT\n   * extended client_cert file to allow loading of a chain of PEM\n     encoded certificates\n   * extended beacon reporting functionality\n   * extended D-Bus interface with number of new properties\n   * fixed a regression in FT-over-DS with mac80211-based drivers\n   * OpenSSL: allow systemwide policies to be overridden\n   * extended driver flags indication for separate 802.1X and PSK\n     4-way handshake offload capability\n   * added support for random P2P Device/Interface Address use\n   * extended PEAP to derive EMSK to enable use with ERP/FILS\n   * extended WPS to allow SAE configuration to be added automatically\n     for PSK (wps_cred_add_sae=1)\n   * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)\n   * extended domain_match and domain_suffix_match to allow list of values\n   * added a RSN workaround for misbehaving PMF APs that advertise\n     IGTK/BIP KeyID using incorrect byte order\n   * fixed PTK rekeying with FILS and FT\n   * fixed WPA packet number reuse with replayed messages and key\n     reinstallation\n     [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,\n     CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,\n     CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)\n   * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant\n     [https://w1.fi/security/2018-1/] (CVE-2018-14526)\n   * added support for FILS (IEEE 802.11ai) shared key authentication\n   * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;\n     and transition mode defined by WFA)\n   * added support for DPP (Wi-Fi Device Provisioning Protocol)\n   * added support for RSA 3k key case with Suite B 192-bit level\n   * fixed Suite B PMKSA caching not to update PMKID during each 4-way\n     handshake\n   * fixed EAP-pwd pre-processing with PasswordHashHash\n   * added EAP-pwd client support for salted passwords\n   * fixed a regression in TDLS prohibited bit validation\n   * started to use estimated throughput to avoid undesired signal\n     strength based roaming decision\n   * MACsec/MKA:\n     - new macsec_linux driver interface support for the Linux\n       kernel macsec module\n     - number of fixes and extensions\n   * added support for external persistent storage of PMKSA cache\n     (PMKSA_GET/PMKSA_ADD control interface commands; and\n      MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)\n   * fixed mesh channel configuration pri/sec switch case\n   * added support for beacon report\n   * large number of other fixes, cleanup, and extensions\n   * added support for randomizing local address for GAS queries\n     (gas_rand_mac_addr parameter)\n   * fixed EAP-SIM/AKA/AKA\u0027 ext auth cases within TLS tunnel\n   * added option for using random WPS UUID (auto_uuid=1)\n   * added SHA256-hash support for OCSP certificate matching\n   * fixed EAP-AKA\u0027 to add AT_KDF into Synchronization-Failure\n   * fixed a regression in RSN pre-authentication candidate selection\n   * added option to configure allowed group management cipher suites\n     (group_mgmt network profile parameter)\n   * removed all PeerKey functionality\n   * fixed nl80211 AP and mesh mode configuration regression with\n     Linux 4.15 and newer\n   * added ap_isolate configuration option for AP mode\n   * added support for nl80211 to offload 4-way handshake into the driver\n   * added support for using wolfSSL cryptographic library\n   * SAE\n     - added support for configuring SAE password separately of the\n       WPA2 PSK/passphrase\n     - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection\n       for SAE;\n       note: this is not backwards compatible, i.e., both the AP and\n       station side implementations will need to be update at the same\n       time to maintain interoperability\n     - added support for Password Identifier\n     - fixed FT-SAE PMKID matching\n   * Hotspot 2.0\n     - added support for fetching of Operator Icon Metadata ANQP-element\n     - added support for Roaming Consortium Selection element\n     - added support for Terms and Conditions\n     - added support for OSEN connection in a shared RSN BSS\n     - added support for fetching Venue URL information\n   * added support for using OpenSSL 1.1.1\n   * FT\n     - disabled PMKSA caching with FT since it is not fully functional\n     - added support for SHA384 based AKM\n     - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,\n       BIP-GMAC-256 in addition to previously supported BIP-CMAC-128\n     - fixed additional IE inclusion in Reassociation Request frame when\n       using FT protocol\n\n- Changed service-files for start after network (systemd-networkd).\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-2053",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_2053-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:2053-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2R3VXKTYLLUYFBZQ2NNAI5NSZOBXISJZ/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:2053-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2R3VXKTYLLUYFBZQ2NNAI5NSZOBXISJZ/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131644",
        "url": "https://bugzilla.suse.com/1131644"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131868",
        "url": "https://bugzilla.suse.com/1131868"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131870",
        "url": "https://bugzilla.suse.com/1131870"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131871",
        "url": "https://bugzilla.suse.com/1131871"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131872",
        "url": "https://bugzilla.suse.com/1131872"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131874",
        "url": "https://bugzilla.suse.com/1131874"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1133640",
        "url": "https://bugzilla.suse.com/1133640"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1144443",
        "url": "https://bugzilla.suse.com/1144443"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1150934",
        "url": "https://bugzilla.suse.com/1150934"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1156920",
        "url": "https://bugzilla.suse.com/1156920"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1166933",
        "url": "https://bugzilla.suse.com/1166933"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1167331",
        "url": "https://bugzilla.suse.com/1167331"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 930077",
        "url": "https://bugzilla.suse.com/930077"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 930078",
        "url": "https://bugzilla.suse.com/930078"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 930079",
        "url": "https://bugzilla.suse.com/930079"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-4141 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-4141/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-4142 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-4142/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-4143 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-4143/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8041 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8041/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13077 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13077/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13078 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13078/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13079 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13080 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13080/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13081 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13081/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13082 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13082/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13086 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13086/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13087 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13087/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13088 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13088/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-14526 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-14526/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-11555 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-11555/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-13377 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-13377/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-16275 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-16275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9494 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9494/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9495 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9495/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9497 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9497/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9498 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9498/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9499 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9499/"
      }
    ],
    "title": "Security update for wpa_supplicant",
    "tracking": {
      "current_release_date": "2020-11-26T17:28:36Z",
      "generator": {
        "date": "2020-11-26T17:28:36Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:2053-1",
      "initial_release_date": "2020-11-26T17:28:36Z",
      "revision_history": [
        {
          "date": "2020-11-26T17:28:36Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wpa_supplicant-2.9-lp151.5.10.1.i586",
                "product": {
                  "name": "wpa_supplicant-2.9-lp151.5.10.1.i586",
                  "product_id": "wpa_supplicant-2.9-lp151.5.10.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
                "product": {
                  "name": "wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
                  "product_id": "wpa_supplicant-gui-2.9-lp151.5.10.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wpa_supplicant-2.9-lp151.5.10.1.x86_64",
                "product": {
                  "name": "wpa_supplicant-2.9-lp151.5.10.1.x86_64",
                  "product_id": "wpa_supplicant-2.9-lp151.5.10.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64",
                "product": {
                  "name": "wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64",
                  "product_id": "wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wpa_supplicant-2.9-lp151.5.10.1.i586 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586"
        },
        "product_reference": "wpa_supplicant-2.9-lp151.5.10.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wpa_supplicant-2.9-lp151.5.10.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64"
        },
        "product_reference": "wpa_supplicant-2.9-lp151.5.10.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wpa_supplicant-gui-2.9-lp151.5.10.1.i586 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586"
        },
        "product_reference": "wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        },
        "product_reference": "wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-4141",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-4141"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-4141",
          "url": "https://www.suse.com/security/cve/CVE-2015-4141"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915323 for CVE-2015-4141",
          "url": "https://bugzilla.suse.com/915323"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930077 for CVE-2015-4141",
          "url": "https://bugzilla.suse.com/930077"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-4141"
    },
    {
      "cve": "CVE-2015-4142",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-4142"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-4142",
          "url": "https://www.suse.com/security/cve/CVE-2015-4142"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915323 for CVE-2015-4142",
          "url": "https://bugzilla.suse.com/915323"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930078 for CVE-2015-4142",
          "url": "https://bugzilla.suse.com/930078"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-4142"
    },
    {
      "cve": "CVE-2015-4143",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-4143"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-4143",
          "url": "https://www.suse.com/security/cve/CVE-2015-4143"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930079 for CVE-2015-4143",
          "url": "https://bugzilla.suse.com/930079"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-4143"
    },
    {
      "cve": "CVE-2015-8041",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8041"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8041",
          "url": "https://www.suse.com/security/cve/CVE-2015-8041"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937419 for CVE-2015-8041",
          "url": "https://bugzilla.suse.com/937419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8041"
    },
    {
      "cve": "CVE-2017-13077",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13077"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13077",
          "url": "https://www.suse.com/security/cve/CVE-2017-13077"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13077",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13077",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063963 for CVE-2017-13077",
          "url": "https://bugzilla.suse.com/1063963"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13077",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13077"
    },
    {
      "cve": "CVE-2017-13078",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13078"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13078",
          "url": "https://www.suse.com/security/cve/CVE-2017-13078"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063667 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1063667"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13078"
    },
    {
      "cve": "CVE-2017-13079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13079",
          "url": "https://www.suse.com/security/cve/CVE-2017-13079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13079",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13079",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13079",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13079"
    },
    {
      "cve": "CVE-2017-13080",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13080"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13080",
          "url": "https://www.suse.com/security/cve/CVE-2017-13080"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063667 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1063667"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063671 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1063671"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1066295 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1066295"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1105108 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1105108"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178872 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1178872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13080"
    },
    {
      "cve": "CVE-2017-13081",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13081"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13081",
          "url": "https://www.suse.com/security/cve/CVE-2017-13081"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1066295 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1066295"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1105108 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1105108"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13081"
    },
    {
      "cve": "CVE-2017-13082",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13082"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13082",
          "url": "https://www.suse.com/security/cve/CVE-2017-13082"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13082"
    },
    {
      "cve": "CVE-2017-13086",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13086"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13086",
          "url": "https://www.suse.com/security/cve/CVE-2017-13086"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13086",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13086",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13086",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13086"
    },
    {
      "cve": "CVE-2017-13087",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13087"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13087",
          "url": "https://www.suse.com/security/cve/CVE-2017-13087"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13087",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13087",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13087",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13087"
    },
    {
      "cve": "CVE-2017-13088",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13088"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13088",
          "url": "https://www.suse.com/security/cve/CVE-2017-13088"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13088",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13088",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13088",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13088"
    },
    {
      "cve": "CVE-2018-14526",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-14526"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-14526",
          "url": "https://www.suse.com/security/cve/CVE-2018-14526"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1104205 for CVE-2018-14526",
          "url": "https://bugzilla.suse.com/1104205"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-14526"
    },
    {
      "cve": "CVE-2019-11555",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-11555"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-11555",
          "url": "https://www.suse.com/security/cve/CVE-2019-11555"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1133640 for CVE-2019-11555",
          "url": "https://bugzilla.suse.com/1133640"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-11555"
    },
    {
      "cve": "CVE-2019-13377",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-13377"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-13377",
          "url": "https://www.suse.com/security/cve/CVE-2019-13377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1144443 for CVE-2019-13377",
          "url": "https://bugzilla.suse.com/1144443"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-13377"
    },
    {
      "cve": "CVE-2019-16275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-16275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-16275",
          "url": "https://www.suse.com/security/cve/CVE-2019-16275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1150934 for CVE-2019-16275",
          "url": "https://bugzilla.suse.com/1150934"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-16275"
    },
    {
      "cve": "CVE-2019-9494",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9494"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9494",
          "url": "https://www.suse.com/security/cve/CVE-2019-9494"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131291 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1131291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131868 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1131868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194732 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1194732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9494"
    },
    {
      "cve": "CVE-2019-9495",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9495"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9495",
          "url": "https://www.suse.com/security/cve/CVE-2019-9495"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131291 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1131291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131870 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1131870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194733 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1194733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-9495"
    },
    {
      "cve": "CVE-2019-9497",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9497"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9497",
          "url": "https://www.suse.com/security/cve/CVE-2019-9497"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-9497"
    },
    {
      "cve": "CVE-2019-9498",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9498"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9498",
          "url": "https://www.suse.com/security/cve/CVE-2019-9498"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9498"
    },
    {
      "cve": "CVE-2019-9499",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9499"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
          "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9499",
          "url": "https://www.suse.com/security/cve/CVE-2019-9499"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-2.9-lp151.5.10.1.x86_64",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.i586",
            "openSUSE Leap 15.1:wpa_supplicant-gui-2.9-lp151.5.10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-26T17:28:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9499"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for wpa_supplicant",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for wpa_supplicant fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934).\n\nNon-security issues fixed:\n\n- Enable SAE support (jsc#SLE-14992).\n- Limit P2P_DEVICE name to appropriate ifname size.\n- Fix wicked wlan (bsc#1156920)\n- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)\n- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)\n- Fix WLAN config on boot with wicked. (bsc#1166933)\n- Update to 2.9 release:\n   * SAE changes\n     - disable use of groups using Brainpool curves\n     - improved protection against side channel attacks\n     [https://w1.fi/security/2019-6/]\n   * EAP-pwd changes\n     - disable use of groups using Brainpool curves\n     - allow the set of groups to be configured (eap_pwd_groups)\n     - improved protection against side channel attacks\n     [https://w1.fi/security/2019-6/]\n   * fixed FT-EAP initial mobility domain association using PMKSA caching\n     (disabled by default for backwards compatibility; can be enabled\n     with ft_eap_pmksa_caching=1)\n   * fixed a regression in OpenSSL 1.1+ engine loading\n   * added validation of RSNE in (Re)Association Response frames\n   * fixed DPP bootstrapping URI parser of channel list\n   * extended EAP-SIM/AKA fast re-authentication to allow use with FILS\n   * extended ca_cert_blob to support PEM format\n   * improved robustness of P2P Action frame scheduling\n   * added support for EAP-SIM/AKA using anonymous@realm identity\n   * fixed Hotspot 2.0 credential selection based on roaming consortium\n     to ignore credentials without a specific EAP method\n   * added experimental support for EAP-TEAP peer (RFC 7170)\n   * added experimental support for EAP-TLS peer with TLS v1.3\n   * fixed a regression in WMM parameter configuration for a TDLS peer\n   * fixed a regression in operation with drivers that offload 802.1X\n     4-way handshake\n   * fixed an ECDH operation corner case with OpenSSL\n   * SAE changes\n     - added support for SAE Password Identifier\n     - changed default configuration to enable only groups 19, 20, 21\n       (i.e., disable groups 25 and 26) and disable all unsuitable groups\n       completely based on REVmd changes\n     - do not regenerate PWE unnecessarily when the AP uses the\n       anti-clogging token mechanisms\n     - fixed some association cases where both SAE and FT-SAE were enabled\n       on both the station and the selected AP\n     - started to prefer FT-SAE over SAE AKM if both are enabled\n     - started to prefer FT-SAE over FT-PSK if both are enabled\n     - fixed FT-SAE when SAE PMKSA caching is used\n     - reject use of unsuitable groups based on new implementation guidance\n       in REVmd (allow only FFC groups with prime \u003e= 3072 bits and ECC\n       groups with prime \u003e= 256)\n     - minimize timing and memory use differences in PWE derivation\n       [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)\n   * EAP-pwd changes\n     - minimize timing and memory use differences in PWE derivation\n       [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)\n     - verify server scalar/element\n       [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,\n       CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)\n     - fix message reassembly issue with unexpected fragment\n       [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)\n     - enforce rand,mask generation rules more strictly\n     - fix a memory leak in PWE derivation\n     - disallow ECC groups with a prime under 256 bits (groups 25, 26, and\n       27)\n     - SAE/EAP-pwd side-channel attack update\n       [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)\n   * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y\n   * Hotspot 2.0 changes\n     - do not indicate release number that is higher than the one\n       AP supports\n     - added support for release number 3\n     - enable PMF automatically for network profiles created from\n       credentials\n   * fixed OWE network profile saving\n   * fixed DPP network profile saving\n   * added support for RSN operating channel validation\n     (CONFIG_OCV=y and network profile parameter ocv=1)\n   * added Multi-AP backhaul STA support\n   * fixed build with LibreSSL\n   * number of MKA/MACsec fixes and extensions\n   * extended domain_match and domain_suffix_match to allow list of values\n   * fixed dNSName matching in domain_match and domain_suffix_match when\n     using wolfSSL\n   * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both\n     are enabled\n   * extended nl80211 Connect and external authentication to support\n     SAE, FT-SAE, FT-EAP-SHA384\n   * fixed KEK2 derivation for FILS+FT\n   * extended client_cert file to allow loading of a chain of PEM\n     encoded certificates\n   * extended beacon reporting functionality\n   * extended D-Bus interface with number of new properties\n   * fixed a regression in FT-over-DS with mac80211-based drivers\n   * OpenSSL: allow systemwide policies to be overridden\n   * extended driver flags indication for separate 802.1X and PSK\n     4-way handshake offload capability\n   * added support for random P2P Device/Interface Address use\n   * extended PEAP to derive EMSK to enable use with ERP/FILS\n   * extended WPS to allow SAE configuration to be added automatically\n     for PSK (wps_cred_add_sae=1)\n   * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)\n   * extended domain_match and domain_suffix_match to allow list of values\n   * added a RSN workaround for misbehaving PMF APs that advertise\n     IGTK/BIP KeyID using incorrect byte order\n   * fixed PTK rekeying with FILS and FT\n   * fixed WPA packet number reuse with replayed messages and key\n     reinstallation\n     [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,\n     CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,\n     CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)\n   * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant\n     [https://w1.fi/security/2018-1/] (CVE-2018-14526)\n   * added support for FILS (IEEE 802.11ai) shared key authentication\n   * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;\n     and transition mode defined by WFA)\n   * added support for DPP (Wi-Fi Device Provisioning Protocol)\n   * added support for RSA 3k key case with Suite B 192-bit level\n   * fixed Suite B PMKSA caching not to update PMKID during each 4-way\n     handshake\n   * fixed EAP-pwd pre-processing with PasswordHashHash\n   * added EAP-pwd client support for salted passwords\n   * fixed a regression in TDLS prohibited bit validation\n   * started to use estimated throughput to avoid undesired signal\n     strength based roaming decision\n   * MACsec/MKA:\n     - new macsec_linux driver interface support for the Linux\n       kernel macsec module\n     - number of fixes and extensions\n   * added support for external persistent storage of PMKSA cache\n     (PMKSA_GET/PMKSA_ADD control interface commands; and\n      MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)\n   * fixed mesh channel configuration pri/sec switch case\n   * added support for beacon report\n   * large number of other fixes, cleanup, and extensions\n   * added support for randomizing local address for GAS queries\n     (gas_rand_mac_addr parameter)\n   * fixed EAP-SIM/AKA/AKA\u0027 ext auth cases within TLS tunnel\n   * added option for using random WPS UUID (auto_uuid=1)\n   * added SHA256-hash support for OCSP certificate matching\n   * fixed EAP-AKA\u0027 to add AT_KDF into Synchronization-Failure\n   * fixed a regression in RSN pre-authentication candidate selection\n   * added option to configure allowed group management cipher suites\n     (group_mgmt network profile parameter)\n   * removed all PeerKey functionality\n   * fixed nl80211 AP and mesh mode configuration regression with\n     Linux 4.15 and newer\n   * added ap_isolate configuration option for AP mode\n   * added support for nl80211 to offload 4-way handshake into the driver\n   * added support for using wolfSSL cryptographic library\n   * SAE\n     - added support for configuring SAE password separately of the\n       WPA2 PSK/passphrase\n     - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection\n       for SAE;\n       note: this is not backwards compatible, i.e., both the AP and\n       station side implementations will need to be update at the same\n       time to maintain interoperability\n     - added support for Password Identifier\n     - fixed FT-SAE PMKID matching\n   * Hotspot 2.0\n     - added support for fetching of Operator Icon Metadata ANQP-element\n     - added support for Roaming Consortium Selection element\n     - added support for Terms and Conditions\n     - added support for OSEN connection in a shared RSN BSS\n     - added support for fetching Venue URL information\n   * added support for using OpenSSL 1.1.1\n   * FT\n     - disabled PMKSA caching with FT since it is not fully functional\n     - added support for SHA384 based AKM\n     - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,\n       BIP-GMAC-256 in addition to previously supported BIP-CMAC-128\n     - fixed additional IE inclusion in Reassociation Request frame when\n       using FT protocol\n\n- Changed service-files for start after network (systemd-networkd).\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-2059",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_2059-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:2059-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5HDY6AZL2NYOKU57GM74M5JHC5SYA3IY/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:2059-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5HDY6AZL2NYOKU57GM74M5JHC5SYA3IY/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131644",
        "url": "https://bugzilla.suse.com/1131644"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131868",
        "url": "https://bugzilla.suse.com/1131868"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131870",
        "url": "https://bugzilla.suse.com/1131870"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131871",
        "url": "https://bugzilla.suse.com/1131871"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131872",
        "url": "https://bugzilla.suse.com/1131872"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1131874",
        "url": "https://bugzilla.suse.com/1131874"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1133640",
        "url": "https://bugzilla.suse.com/1133640"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1144443",
        "url": "https://bugzilla.suse.com/1144443"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1150934",
        "url": "https://bugzilla.suse.com/1150934"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1156920",
        "url": "https://bugzilla.suse.com/1156920"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1166933",
        "url": "https://bugzilla.suse.com/1166933"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1167331",
        "url": "https://bugzilla.suse.com/1167331"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 930077",
        "url": "https://bugzilla.suse.com/930077"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 930078",
        "url": "https://bugzilla.suse.com/930078"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 930079",
        "url": "https://bugzilla.suse.com/930079"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-4141 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-4141/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-4142 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-4142/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-4143 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-4143/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-8041 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-8041/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13077 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13077/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13078 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13078/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13079 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13080 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13080/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13081 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13081/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13082 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13082/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13086 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13086/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13087 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13087/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13088 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13088/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-14526 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-14526/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-11555 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-11555/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-13377 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-13377/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-16275 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-16275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9494 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9494/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9495 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9495/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9497 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9497/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9498 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9498/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9499 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9499/"
      }
    ],
    "title": "Security update for wpa_supplicant",
    "tracking": {
      "current_release_date": "2020-11-27T05:23:21Z",
      "generator": {
        "date": "2020-11-27T05:23:21Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:2059-1",
      "initial_release_date": "2020-11-27T05:23:21Z",
      "revision_history": [
        {
          "date": "2020-11-27T05:23:21Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wpa_supplicant-2.9-lp152.8.3.1.i586",
                "product": {
                  "name": "wpa_supplicant-2.9-lp152.8.3.1.i586",
                  "product_id": "wpa_supplicant-2.9-lp152.8.3.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
                "product": {
                  "name": "wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
                  "product_id": "wpa_supplicant-gui-2.9-lp152.8.3.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wpa_supplicant-2.9-lp152.8.3.1.x86_64",
                "product": {
                  "name": "wpa_supplicant-2.9-lp152.8.3.1.x86_64",
                  "product_id": "wpa_supplicant-2.9-lp152.8.3.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64",
                "product": {
                  "name": "wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64",
                  "product_id": "wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wpa_supplicant-2.9-lp152.8.3.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586"
        },
        "product_reference": "wpa_supplicant-2.9-lp152.8.3.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wpa_supplicant-2.9-lp152.8.3.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64"
        },
        "product_reference": "wpa_supplicant-2.9-lp152.8.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wpa_supplicant-gui-2.9-lp152.8.3.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586"
        },
        "product_reference": "wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        },
        "product_reference": "wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-4141",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-4141"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-4141",
          "url": "https://www.suse.com/security/cve/CVE-2015-4141"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915323 for CVE-2015-4141",
          "url": "https://bugzilla.suse.com/915323"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930077 for CVE-2015-4141",
          "url": "https://bugzilla.suse.com/930077"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-4141"
    },
    {
      "cve": "CVE-2015-4142",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-4142"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-4142",
          "url": "https://www.suse.com/security/cve/CVE-2015-4142"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915323 for CVE-2015-4142",
          "url": "https://bugzilla.suse.com/915323"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930078 for CVE-2015-4142",
          "url": "https://bugzilla.suse.com/930078"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-4142"
    },
    {
      "cve": "CVE-2015-4143",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-4143"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-4143",
          "url": "https://www.suse.com/security/cve/CVE-2015-4143"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930079 for CVE-2015-4143",
          "url": "https://bugzilla.suse.com/930079"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-4143"
    },
    {
      "cve": "CVE-2015-8041",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-8041"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-8041",
          "url": "https://www.suse.com/security/cve/CVE-2015-8041"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937419 for CVE-2015-8041",
          "url": "https://bugzilla.suse.com/937419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-8041"
    },
    {
      "cve": "CVE-2017-13077",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13077"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13077",
          "url": "https://www.suse.com/security/cve/CVE-2017-13077"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13077",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13077",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063963 for CVE-2017-13077",
          "url": "https://bugzilla.suse.com/1063963"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13077",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13077"
    },
    {
      "cve": "CVE-2017-13078",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13078"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13078",
          "url": "https://www.suse.com/security/cve/CVE-2017-13078"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063667 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1063667"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13078"
    },
    {
      "cve": "CVE-2017-13079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13079",
          "url": "https://www.suse.com/security/cve/CVE-2017-13079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13079",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13079",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13079",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13079"
    },
    {
      "cve": "CVE-2017-13080",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13080"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13080",
          "url": "https://www.suse.com/security/cve/CVE-2017-13080"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063667 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1063667"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063671 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1063671"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1066295 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1066295"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1105108 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1105108"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178872 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1178872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13080",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13080"
    },
    {
      "cve": "CVE-2017-13081",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13081"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13081",
          "url": "https://www.suse.com/security/cve/CVE-2017-13081"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1066295 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1066295"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1105108 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1105108"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13081",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13081"
    },
    {
      "cve": "CVE-2017-13082",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13082"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13082",
          "url": "https://www.suse.com/security/cve/CVE-2017-13082"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13082"
    },
    {
      "cve": "CVE-2017-13086",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13086"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13086",
          "url": "https://www.suse.com/security/cve/CVE-2017-13086"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13086",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13086",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13086",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13086"
    },
    {
      "cve": "CVE-2017-13087",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13087"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13087",
          "url": "https://www.suse.com/security/cve/CVE-2017-13087"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13087",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13087",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13087",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13087"
    },
    {
      "cve": "CVE-2017-13088",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13088"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13088",
          "url": "https://www.suse.com/security/cve/CVE-2017-13088"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13088",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13088",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13088",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13088"
    },
    {
      "cve": "CVE-2018-14526",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-14526"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-14526",
          "url": "https://www.suse.com/security/cve/CVE-2018-14526"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1104205 for CVE-2018-14526",
          "url": "https://bugzilla.suse.com/1104205"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-14526"
    },
    {
      "cve": "CVE-2019-11555",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-11555"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-11555",
          "url": "https://www.suse.com/security/cve/CVE-2019-11555"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1133640 for CVE-2019-11555",
          "url": "https://bugzilla.suse.com/1133640"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-11555"
    },
    {
      "cve": "CVE-2019-13377",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-13377"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-13377",
          "url": "https://www.suse.com/security/cve/CVE-2019-13377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1144443 for CVE-2019-13377",
          "url": "https://bugzilla.suse.com/1144443"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-13377"
    },
    {
      "cve": "CVE-2019-16275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-16275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-16275",
          "url": "https://www.suse.com/security/cve/CVE-2019-16275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1150934 for CVE-2019-16275",
          "url": "https://bugzilla.suse.com/1150934"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-16275"
    },
    {
      "cve": "CVE-2019-9494",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9494"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9494",
          "url": "https://www.suse.com/security/cve/CVE-2019-9494"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131291 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1131291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131868 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1131868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194732 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1194732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9494"
    },
    {
      "cve": "CVE-2019-9495",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9495"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9495",
          "url": "https://www.suse.com/security/cve/CVE-2019-9495"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131291 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1131291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131870 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1131870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194733 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1194733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-9495"
    },
    {
      "cve": "CVE-2019-9497",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9497"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9497",
          "url": "https://www.suse.com/security/cve/CVE-2019-9497"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-9497"
    },
    {
      "cve": "CVE-2019-9498",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9498"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9498",
          "url": "https://www.suse.com/security/cve/CVE-2019-9498"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9498",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9498"
    },
    {
      "cve": "CVE-2019-9499",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9499"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
          "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9499",
          "url": "https://www.suse.com/security/cve/CVE-2019-9499"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-2.9-lp152.8.3.1.x86_64",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.i586",
            "openSUSE Leap 15.2:wpa_supplicant-gui-2.9-lp152.8.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-11-27T05:23:21Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9499"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "hostapd-2.9-6.2 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the hostapd-2.9-6.2 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10846",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10846-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13078 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13078/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-13082 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-13082/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-14526 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-14526/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-16275 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-16275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9494 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9494/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9495 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9495/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9496 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9496/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9497 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9497/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-9499 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-9499/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-12695 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-12695/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-30004 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-30004/"
      }
    ],
    "title": "hostapd-2.9-6.2 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10846-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-2.9-6.2.aarch64",
                "product": {
                  "name": "hostapd-2.9-6.2.aarch64",
                  "product_id": "hostapd-2.9-6.2.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-2.9-6.2.ppc64le",
                "product": {
                  "name": "hostapd-2.9-6.2.ppc64le",
                  "product_id": "hostapd-2.9-6.2.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-2.9-6.2.s390x",
                "product": {
                  "name": "hostapd-2.9-6.2.s390x",
                  "product_id": "hostapd-2.9-6.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-2.9-6.2.x86_64",
                "product": {
                  "name": "hostapd-2.9-6.2.x86_64",
                  "product_id": "hostapd-2.9-6.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-6.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64"
        },
        "product_reference": "hostapd-2.9-6.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-6.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le"
        },
        "product_reference": "hostapd-2.9-6.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-6.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x"
        },
        "product_reference": "hostapd-2.9-6.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-2.9-6.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        },
        "product_reference": "hostapd-2.9-6.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-13078",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13078"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13078",
          "url": "https://www.suse.com/security/cve/CVE-2017-13078"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063667 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1063667"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13078",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13078"
    },
    {
      "cve": "CVE-2017-13082",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-13082"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-13082",
          "url": "https://www.suse.com/security/cve/CVE-2017-13082"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056061 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1056061"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1063479 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1063479"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179588 for CVE-2017-13082",
          "url": "https://bugzilla.suse.com/1179588"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-13082"
    },
    {
      "cve": "CVE-2018-14526",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-14526"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-14526",
          "url": "https://www.suse.com/security/cve/CVE-2018-14526"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1104205 for CVE-2018-14526",
          "url": "https://bugzilla.suse.com/1104205"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-14526"
    },
    {
      "cve": "CVE-2019-16275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-16275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-16275",
          "url": "https://www.suse.com/security/cve/CVE-2019-16275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1150934 for CVE-2019-16275",
          "url": "https://bugzilla.suse.com/1150934"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-16275"
    },
    {
      "cve": "CVE-2019-9494",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9494"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9494",
          "url": "https://www.suse.com/security/cve/CVE-2019-9494"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131291 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1131291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131868 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1131868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194732 for CVE-2019-9494",
          "url": "https://bugzilla.suse.com/1194732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9494"
    },
    {
      "cve": "CVE-2019-9495",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9495"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9495",
          "url": "https://www.suse.com/security/cve/CVE-2019-9495"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131291 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1131291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131870 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1131870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194733 for CVE-2019-9495",
          "url": "https://bugzilla.suse.com/1194733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-9495"
    },
    {
      "cve": "CVE-2019-9496",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9496"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9496",
          "url": "https://www.suse.com/security/cve/CVE-2019-9496"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131869 for CVE-2019-9496",
          "url": "https://bugzilla.suse.com/1131869"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-9496"
    },
    {
      "cve": "CVE-2019-9497",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9497"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9497",
          "url": "https://www.suse.com/security/cve/CVE-2019-9497"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9497",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-9497"
    },
    {
      "cve": "CVE-2019-9499",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-9499"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-9499",
          "url": "https://www.suse.com/security/cve/CVE-2019-9499"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131871 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131872 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1131874 for CVE-2019-9499",
          "url": "https://bugzilla.suse.com/1131874"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-9499"
    },
    {
      "cve": "CVE-2020-12695",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-12695"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-12695",
          "url": "https://www.suse.com/security/cve/CVE-2020-12695"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172700 for CVE-2020-12695",
          "url": "https://bugzilla.suse.com/1172700"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179447 for CVE-2020-12695",
          "url": "https://bugzilla.suse.com/1179447"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-12695"
    },
    {
      "cve": "CVE-2021-30004",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-30004"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
          "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-30004",
          "url": "https://www.suse.com/security/cve/CVE-2021-30004"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184348 for CVE-2021-30004",
          "url": "https://bugzilla.suse.com/1184348"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hostapd-2.9-6.2.aarch64",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.ppc64le",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.s390x",
            "openSUSE Tumbleweed:hostapd-2.9-6.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-30004"
    }
  ]
}