Univention Bugzilla – Bug 51794
wpa: Multiple issues (4.4)
Last modified: 2020-08-12 16:18:16 CEST
New Debian wpa 2:2.4-1+deb9u7A~4.4.5.202008100901 fixes: This update addresses the following issues: * Not preventig the use of low quality PRNG in EAP mode leads to insufficient entropy (CVE-2019-10064) * UPnP SUBSCRIBE misbehavior in WPS AP (CVE-2020-12695)
--- mirror/ftp/4.4/unmaintained/component/4.4-5-errata/source/wpa_2.4-1+deb9u6A~4.4.5.202007221413.dsc +++ apt/ucs_4.4-0-errata4.4-5/source/wpa_2.4-1+deb9u7A~4.4.5.202008100901.dsc @@ -1,7 +1,18 @@ -2:2.4-1+deb9u6A~4.4.5.202007221413 [Wed, 22 Jul 2020 14:29:49 +0200] Univention builddaemon <buildd@univention.de>: +2:2.4-1+deb9u7A~4.4.5.202008100901 [Mon, 10 Aug 2020 09:10:09 +0200] Univention builddaemon <buildd@univention.de>: * UCS auto build. The following patches have been applied to the original source package eapol_test + +2:2.4-1+deb9u7 [Sun, 09 Aug 2020 00:22:36 +0530] Utkarsh Gupta <utkarsh@debian.org>: + + * Add patch to fix: + - EAP-pwd server: Use os_get_random() for unpredictable token. + (Fixes: CVE-2019-10064) + - CVE-2020-12695: + - WPS UPnP: Do not allow event subscriptions with URLs to other networks. + - For the other issues: + - WPS UPnP: Fix event message generation using a long URL path. + - WPS UPnP: Handle HTTP initiation failures for events more properly. 2:2.4-1+deb9u6 [Tue, 07 Jul 2020 11:52:38 +0200] Andrej Shadura <andrewsh@debian.org>: <http://10.200.17.11/4.4-5/#6821358931421438144>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-5] c936c818d1 Bug #51794: wpa 2:2.4-1+deb9u7A~4.4.5.202008100901 doc/errata/staging/wpa.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x710>