Bug 49285 - wpa: Multiple issues (4.3)
wpa: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P3 normal (vote)
: UCS 4.3-4-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-04-13 10:53 CEST by Quality Assurance
Modified: 2019-04-17 15:33 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 8.1 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2019-04-13 10:53:23 CEST
New Debian wpa 2:2.4-1+deb9u3A~4.3.4.201904131053 fixes:
This update addresses the following issues:
* EAP-pwd cache side-channel attack (CVE-2019-9495)
* EAP-pwd server not checking for reflection attack (CVE-2019-9497)
* EAP-pwd server missing commit validation for scalar/element (CVE-2019-9498)
* EAP-pwd peer missing commit validation for scalar/element (CVE-2019-9499)
Comment 1 Quality Assurance univentionstaff 2019-04-15 09:00:50 CEST
--- mirror/ftp/4.3/unmaintained/4.3-3/source/wpa_2.4-1+deb9u2A~4.3.2.201811191242.dsc
+++ apt/ucs_4.3-0-errata4.3-4/source/wpa_2.4-1+deb9u3A~4.3.4.201904131053.dsc
@@ -1,7 +1,23 @@
-2:2.4-1+deb9u2A~4.3.2.201811191242 [Mon, 19 Nov 2018 12:42:29 +0100] Univention builddaemon <buildd@univention.de>:
+2:2.4-1+deb9u3A~4.3.4.201904131053 [Sat, 13 Apr 2019 10:53:36 +0200] Univention builddaemon <buildd@univention.de>:
 
   * UCS auto build. The following patches have been applied to the original source package
     eapol_test
+
+2:2.4-1+deb9u3 [Wed, 10 Apr 2019 18:57:51 +0200] Andrej Shadura <andrewsh@debian.org>:
+
+  * Apply a partial security fix for CVE-2019-9495:
+    - OpenSSL: Use constant time operations for private bignums.
+    - See https://w1.fi/security/2019-2/ for more details.
+  * Apply security fixes:
+    - EAP-pwd server: Detect reflection attacks (CVE-2019-9497)
+    - EAP-pwd client: Verify received scalar and element
+      (partial fix for CVE-2019-9498)
+    - EAP-pwd server: Verify received scalar and element
+      (partial fix for CVE-2019-9499)
+    - See https://w1.fi/security/2019-4/ for more details.
+  * Add an upstream patch to add crypto_ec_point_cmp() required
+    by the fixes for CVE-2019-9497.
+  * Forcefully enable compilation of the ECC code.
 
 2:2.4-1+deb9u2 [Thu, 09 Aug 2018 09:23:49 +0200] Andrej Shadura <andrewsh@debian.org>:
 

<http://10.200.17.11/4.3-4/#1282518307451814778>
Comment 2 Philipp Hahn univentionstaff 2019-04-15 09:36:34 CEST
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.3-4] 1545bf0f6f Bug #49285: wpa 2:2.4-1+deb9u3A~4.3.4.201904131053
 doc/errata/staging/wpa.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

[4.3-4] 88d7d83f29 Bug #49285: wpa 2:2.4-1+deb9u3A~4.3.4.201904131053
 doc/errata/staging/wpa.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
Comment 3 Erik Damrose univentionstaff 2019-04-17 15:33:49 CEST
<http://errata.software-univention.de/ucs/4.3/479.html>