CVE-2019-13377

2019-08-1517:15:13

Google

osv.dev

7.2 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.9%

JSON

The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.

CPENameOperatorVersion
hostapdeq0.6.9-r1
wpa_supplicanteq2.3-r0
wpa_supplicanteq2.6-r13
hostapdeq2.1-r0
hostapdeq2.4-r0
hostapdeq1.0-r0
wpa_supplicanteq0.6.10-r0
wpa_supplicanteq2.4-r1
wpa_supplicanteq0.7.2-r1
hostapdeq2.6-r1

Name	Operator	Version
hostapd	eq	0.6.9-r1
wpa_supplicant	eq	2.3-r0
wpa_supplicant	eq	2.6-r13
hostapd	eq	2.1-r0
hostapd	eq	2.4-r0
hostapd	eq	1.0-r0
wpa_supplicant	eq	0.6.10-r0
wpa_supplicant	eq	2.4-r1
wpa_supplicant	eq	0.7.2-r1
hostapd	eq	2.6-r1