Univention Bugzilla – Bug 57108
wpa: Multiple issues (5.0)
Last modified: 2024-03-07 13:07:42 CET
New Debian wpa 2:2.7+git20190128+0c1e29f-6+deb10u4A~5.0.6.202403041312 fixes: This update addresses the following issue: 2:2.7+git20190128+0c1e29f-6+deb10u4 (Tue, 27 Feb 2024 13:44:35 +0000) * Non-maintainer upload by the Debian LTS team. * CVE-2023-52160: Prevent a potential authentication bypass vulnerability in the PEAP protocol implementation. For an attack to have been successful, wpa_supplicant must have been configured to not verify the network's TLS certificate during Phase 1 of the authentication cycle; a eap_peap_decrypt vulnerability could have been used to skip Phase 2 authentication by sending an EAP-TLV Success packet instead of starting Phase 2.
--- mirror/ftp/pool/main/w/wpa/wpa_2.7+git20190128+0c1e29f-6+deb10u3A~5.0.0.202104251534.dsc +++ apt/ucs_5.0-0-errata5.0-6/source/wpa_2.7+git20190128+0c1e29f-6+deb10u4A~5.0.6.202403041312.dsc @@ -1,7 +1,18 @@ -2:2.7+git20190128+0c1e29f-6+deb10u3A~5.0.0.202104251534 [Sun, 25 Apr 2021 15:35:00 +0200] Univention builddaemon <buildd@univention.de>: +2:2.7+git20190128+0c1e29f-6+deb10u4A~5.0.6.202403041312 [Mon, 04 Mar 2024 13:12:36 +0100] Univention builddaemon <buildd@univention.de>: * UCS auto build. The following patches have been applied to the original source package - eapol_test + eapol_test.patch + +2:2.7+git20190128+0c1e29f-6+deb10u4 [Tue, 27 Feb 2024 13:44:35 +0000] Chris Lamb <lamby@debian.org>: + + * Non-maintainer upload by the Debian LTS team. + * CVE-2023-52160: Prevent a potential authentication bypass vulnerability in + the PEAP protocol implementation. For an attack to have been successful, + wpa_supplicant must have been configured to not verify the network's TLS + certificate during Phase 1 of the authentication cycle; a eap_peap_decrypt + vulnerability could have been used to skip Phase 2 authentication by + sending an EAP-TLV Success packet instead of starting Phase 2. + (Closes: #1064061) 2:2.7+git20190128+0c1e29f-6+deb10u3 [Fri, 16 Apr 2021 15:07:06 +0200] Salvatore Bonaccorso <carnil@debian.org>: <http://piuparts.knut.univention.de/5.0-6/#2785608867572285900>
(In reply to Quality Assurance from comment #1) Package was imported and re-build again as 2:2.7+git20190128+0c1e29f-6+deb10u4A~5.0.6.202403041401 <http://piuparts.knut.univention.de/5.0-6/#2828149653480565425>
OK: bug OK: yaml OK: announce_errata OK: patch OK: piuparts [5.0-6] 8b4c14986a Bug #57108: wpa 2:2.7+git20190128+0c1e29f-6+deb10u4A~5.0.6.202403041401 doc/errata/staging/wpa.yaml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) [5.0-6] 8213cd1642 Bug #57108: wpa 2:2.7+git20190128+0c1e29f-6+deb10u4A~5.0.6.202403041401 doc/errata/staging/wpa.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) [5.0-6] d2819f6d6a Bug #57108: wpa 2:2.7+git20190128+0c1e29f-6+deb10u4A~5.0.6.202403041312 doc/errata/staging/wpa.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
<https://errata.software-univention.de/#/?erratum=5.0x982>