CVE-2019-9498

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.

This update for hostapd fixes the following issues:

hostapd was updated to version 2.9:

• SAE changes
  • disable use of groups using Brainpool curves
  • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
• EAP-pwd changes
  • disable use of groups using Brainpool curves
  • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
• fixed FT-EAP initial mobility domain association using PMKSA caching
• added configuration of airtime policy
• fixed FILS to and RSNE into (Re)Association Response frames
• fixed DPP bootstrapping URI parser of channel list
• added support for regulatory WMM limitation (for ETSI)
• added support for MACsec Key Agreement using IEEE 802.1X/PSK
• added experimental support for EAP-TEAP server (RFC 7170)
• added experimental support for EAP-TLS server with TLS v1.3
• added support for two server certificates/keys (RSA/ECC)
• added AKMSuiteSelector into 'STA <addr>' control interface data to determine with AKM was used for an association
• added eap_sim_id parameter to allow EAP-SIM/AKA server pseudonym and fast reauthentication use to be disabled
• fixed an ECDH operation corner case with OpenSSL

Update to version 2.8

• SAE changes
  • added support for SAE Password Identifier
  • changed default configuration to enable only group 19 (i.e., disable groups 20, 21, 25, 26 from default configuration) and disable all unsuitable groups completely based on REVmd changes
  • improved anti-clogging token mechanism and SAE authentication frame processing during heavy CPU load; this mitigates some issues with potential DoS attacks trying to flood an AP with large number of SAE messages
  • added Finite Cyclic Group field in status code 77 responses
  • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
  • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494)
  • fixed confirm message validation in error cases [https://w1.fi/security/2019-3/] (CVE-2019-9496)
• EAP-pwd changes
  • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495)
  • verify peer scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497 and CVE-2019-9498)
  • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/]
  • enforce rand,mask generation rules more strictly
  • fix a memory leak in PWE derivation
  • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
• Hotspot 2.0 changes
  • added support for release number 3
  • reject release 2 or newer association without PMF
• added support for RSN operating channel validation (CONFIG_OCV=y and configuration parameter ocv=1)
• added Multi-AP protocol support
• added FTM responder configuration
• fixed build with LibreSSL
• added FT/RRB workaround for short Ethernet frame padding
• fixed KEK2 derivation for FILS+FT
• added RSSI-based association rejection from OCE
• extended beacon reporting functionality
• VLAN changes
  • allow local VLAN management with remote RADIUS authentication
  • add WPA/WPA2 passphrase/PSK -based VLAN assignment
• OpenSSL: allow systemwide policies to be overridden
• extended PEAP to derive EMSK to enable use with ERP/FILS
• extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1)
• fixed FT and SA Query Action frame with AP-MLME-in-driver cases
• OWE: allow Diffie-Hellman Parameter element to be included with DPP in preparation for DPP protocol extension
• RADIUS server: started to accept ERP keyName-NAI as user identity automatically without matching EAP database entry
• fixed PTK rekeying with FILS and FT

wpa_supplicant:

• SAE changes
  • added support for SAE Password Identifier
  • changed default configuration to enable only…

This update for wpa_supplicant fixes the following issues:

Security issue fixed:

• CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934).

Non-security issues fixed:

• Enable SAE support (jsc#SLE-14992).
• Limit P2P_DEVICE name to appropriate ifname size.
• Fix wicked wlan (bsc#1156920)
• Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)
• With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)
• Fix WLAN config on boot with wicked. (bsc#1166933)
• Update to 2.9 release:
  • SAE changes
    • disable use of groups using Brainpool curves
    • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
  • EAP-pwd changes
    • disable use of groups using Brainpool curves
    • allow the set of groups to be configured (eap_pwd_groups)
    • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
  • fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1)
  • fixed a regression in OpenSSL 1.1+ engine loading
  • added validation of RSNE in (Re)Association Response frames
  • fixed DPP bootstrapping URI parser of channel list
  • extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  • extended ca_cert_blob to support PEM format
  • improved robustness of P2P Action frame scheduling
  • added support for EAP-SIM/AKA using anonymous@realm identity
  • fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method
  • added experimental support for EAP-TEAP peer (RFC 7170)
  • added experimental support for EAP-TLS peer with TLS v1.3
  • fixed a regression in WMM parameter configuration for a TDLS peer
  • fixed a regression in operation with drivers that offload 802.1X 4-way handshake
  • fixed an ECDH operation corner case with OpenSSL
  • SAE changes
    • added support for SAE Password Identifier
    • changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes
    • do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms
    • fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP
    • started to prefer FT-SAE over SAE AKM if both are enabled
    • started to prefer FT-SAE over FT-PSK if both are enabled
    • fixed FT-SAE when SAE PMKSA caching is used
    • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
    • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  • EAP-pwd changes
    • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
    • verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
    • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
    • enforce rand,mask generation rules more strictly
    • fix a memory leak in PWE derivation
    • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
    • SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  • fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  • Hotspot 2.0 changes
    • do not indicate release number that is higher than the one AP supports
    • added support for release number 3
    • enable PMF automatically for…

This update for wpa_supplicant fixes the following issues:

Security issue fixed:

• CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934).

Non-security issues fixed:

• Enable SAE support (jsc#SLE-14992).
• Limit P2P_DEVICE name to appropriate ifname size.
• Fix wicked wlan (bsc#1156920)
• Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)
• With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)
• Fix WLAN config on boot with wicked. (bsc#1166933)
• Update to 2.9 release:
  • SAE changes
    • disable use of groups using Brainpool curves
    • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
  • EAP-pwd changes
    • disable use of groups using Brainpool curves
    • allow the set of groups to be configured (eap_pwd_groups)
    • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
  • fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1)
  • fixed a regression in OpenSSL 1.1+ engine loading
  • added validation of RSNE in (Re)Association Response frames
  • fixed DPP bootstrapping URI parser of channel list
  • extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  • extended ca_cert_blob to support PEM format
  • improved robustness of P2P Action frame scheduling
  • added support for EAP-SIM/AKA using anonymous@realm identity
  • fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method
  • added experimental support for EAP-TEAP peer (RFC 7170)
  • added experimental support for EAP-TLS peer with TLS v1.3
  • fixed a regression in WMM parameter configuration for a TDLS peer
  • fixed a regression in operation with drivers that offload 802.1X 4-way handshake
  • fixed an ECDH operation corner case with OpenSSL
  • SAE changes
    • added support for SAE Password Identifier
    • changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes
    • do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms
    • fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP
    • started to prefer FT-SAE over SAE AKM if both are enabled
    • started to prefer FT-SAE over FT-PSK if both are enabled
    • fixed FT-SAE when SAE PMKSA caching is used
    • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
    • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  • EAP-pwd changes
    • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
    • verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
    • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
    • enforce rand,mask generation rules more strictly
    • fix a memory leak in PWE derivation
    • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
    • SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  • fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  • Hotspot 2.0 changes
    • do not indicate release number that is higher than the one AP supports
    • added support for release number 3
    • enable PMF automatically for…

This update for wpa_supplicant fixes the following issues:

Security issue fixed:

• CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934).

Non-security issues fixed:

• Enable SAE support (jsc#SLE-14992).
• Limit P2P_DEVICE name to appropriate ifname size.
• Fix wicked wlan (bsc#1156920)
• Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)
• With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)
• Fix WLAN config on boot with wicked. (bsc#1166933)
• Update to 2.9 release:
  • SAE changes
    • disable use of groups using Brainpool curves
    • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
  • EAP-pwd changes
    • disable use of groups using Brainpool curves
    • allow the set of groups to be configured (eap_pwd_groups)
    • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
  • fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1)
  • fixed a regression in OpenSSL 1.1+ engine loading
  • added validation of RSNE in (Re)Association Response frames
  • fixed DPP bootstrapping URI parser of channel list
  • extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  • extended ca_cert_blob to support PEM format
  • improved robustness of P2P Action frame scheduling
  • added support for EAP-SIM/AKA using anonymous@realm identity
  • fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method
  • added experimental support for EAP-TEAP peer (RFC 7170)
  • added experimental support for EAP-TLS peer with TLS v1.3
  • fixed a regression in WMM parameter configuration for a TDLS peer
  • fixed a regression in operation with drivers that offload 802.1X 4-way handshake
  • fixed an ECDH operation corner case with OpenSSL
  • SAE changes
    • added support for SAE Password Identifier
    • changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes
    • do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms
    • fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP
    • started to prefer FT-SAE over SAE AKM if both are enabled
    • started to prefer FT-SAE over FT-PSK if both are enabled
    • fixed FT-SAE when SAE PMKSA caching is used
    • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
    • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  • EAP-pwd changes
    • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
    • verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
    • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
    • enforce rand,mask generation rules more strictly
    • fix a memory leak in PWE derivation
    • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
    • SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  • fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  • Hotspot 2.0 changes
    • do not indicate release number that is higher than the one AP supports
    • added support for release number 3
    • enable PMF automatically for…

This update for wpa_supplicant fixes the following issues:

wpa_supplicant was updated to 2.9 release:

• SAE changes
  • disable use of groups using Brainpool curves
  • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
• EAP-pwd changes
  • disable use of groups using Brainpool curves
  • allow the set of groups to be configured (eap_pwd_groups)
  • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
• fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1)
• fixed a regression in OpenSSL 1.1+ engine loading
• added validation of RSNE in (Re)Association Response frames
• fixed DPP bootstrapping URI parser of channel list
• extended EAP-SIM/AKA fast re-authentication to allow use with FILS
• extended ca_cert_blob to support PEM format
• improved robustness of P2P Action frame scheduling
• added support for EAP-SIM/AKA using anonymous@realm identity
• fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method
• added experimental support for EAP-TEAP peer (RFC 7170)
• added experimental support for EAP-TLS peer with TLS v1.3
• fixed a regression in WMM parameter configuration for a TDLS peer
• fixed a regression in operation with drivers that offload 802.1X 4-way handshake
• fixed an ECDH operation corner case with OpenSSL
• SAE changes
  • added support for SAE Password Identifier
  • changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes
  • do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms
  • fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP
  • started to prefer FT-SAE over SAE AKM if both are enabled
  • started to prefer FT-SAE over FT-PSK if both are enabled
  • fixed FT-SAE when SAE PMKSA caching is used
  • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
  • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
• EAP-pwd changes
  • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
  • verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
  • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
  • enforce rand,mask generation rules more strictly
  • fix a memory leak in PWE derivation
  • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
  • SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
• fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
• Hotspot 2.0 changes
  • do not indicate release number that is higher than the one AP supports
  • added support for release number 3
  • enable PMF automatically for network profiles created from credentials
• fixed OWE network profile saving
• fixed DPP network profile saving
• added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1)
• added Multi-AP backhaul STA support
• fixed build with LibreSSL
• number of MKA/MACsec fixes and extensions
• extended domain_match and domain_suffix_match to allow list of values *…

This update for wpa_supplicant fixes the following issues:

• CVE-2022-23303, CVE-2022-23304: Fixed SAE/EAP-pwd side-channel attacks (bsc#1194732, bsc#1194733)

• CVE-2021-0326: Fixed P2P group information processing vulnerability (bsc#1181777)

• Fix systemd device ready dependencies in [email protected] file. (bsc#1182805)

• Limit P2P_DEVICE name to appropriate ifname size

• Enable SAE support(jsc#SLE-14992).

• Fix wicked wlan (bsc#1156920)

• Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (bsc#1166933)

• Adjust the service to start after network.target wrt bsc#1165266

Update to 2.9 release:

• SAE changes
  • disable use of groups using Brainpool curves
  • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
• EAP-pwd changes
  • disable use of groups using Brainpool curves
  • allow the set of groups to be configured (eap_pwd_groups)
  • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
• fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1)
• fixed a regression in OpenSSL 1.1+ engine loading
• added validation of RSNE in (Re)Association Response frames
• fixed DPP bootstrapping URI parser of channel list
• extended EAP-SIM/AKA fast re-authentication to allow use with FILS
• extended ca_cert_blob to support PEM format
• improved robustness of P2P Action frame scheduling
• added support for EAP-SIM/AKA using anonymous@realm identity
• fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method
• added experimental support for EAP-TEAP peer (RFC 7170)
• added experimental support for EAP-TLS peer with TLS v1.3
• fixed a regression in WMM parameter configuration for a TDLS peer
• fixed a regression in operation with drivers that offload 802.1X 4-way handshake
• fixed an ECDH operation corner case with OpenSSL
• SAE changes
  • added support for SAE Password Identifier
  • changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes
  • do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms
  • fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP
  • started to prefer FT-SAE over SAE AKM if both are enabled
  • started to prefer FT-SAE over FT-PSK if both are enabled
  • fixed FT-SAE when SAE PMKSA caching is used
  • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
  • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
• EAP-pwd changes
  • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
  • verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
  • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
  • enforce rand,mask generation rules more strictly
  • fix a memory leak in PWE derivation
  • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
  • SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
• fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
• Hotspot 2.0 changes
  • do not indicate release number that is higher than the one AP supports
  • added support for release number 3
  • enable PMF automatically for network profiles created from credentials *…

It was discovered that wpa_supplicant and hostapd were vulnerable to a side channel attack against EAP-pwd. A remote attacker could possibly use this issue to recover certain passwords. (CVE-2019-9495)

Mathy Vanhoef discovered that wpa_supplicant and hostapd incorrectly validated received scalar and element values in EAP-pwd-Commit messages. A remote attacker could possibly use this issue to perform a reflection attack and authenticate without the appropriate password. (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499)

It was discovered that hostapd incorrectly handled obtaining random numbers. In rare cases where the urandom device isn't available, it would fall back to using a low-quality PRNG. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10743)