{"id":"CVE-2019-10064","aliases":["DEBIAN-CVE-2019-10064","DLA-2138-1","DLA-2318-1","EUVD-2019-2125","GHSA-h5p7-cpc2-2j2r","UBUNTU-CVE-2019-10064","openSUSE-SU-2026:12398-1"],"status":"published","title":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library...","description":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03873,"percentile":0.90278,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-331"],"published":"2020-02-28T14:07:14Z","modified":"2026-11-04T17:27:21Z","fixes":[{"ecosystem":"Debian:12","package":"wpa","fixed_in":["2:2.6-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wpa","fixed_in":["2:2.6-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wpa","fixed_in":["2:2.6-7"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"wpa","fixed_in":["2.3-1+deb8u10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.6-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.6-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.6-7"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-1+deb8u10"}]}],"versions":["2.3-1","2.3-1+deb8u1","2.3-1+deb8u2","2.3-1+deb8u3","2.3-1+deb8u4","2.3-1+deb8u5","2.3-1+deb8u6","2.3-1+deb8u7","2.3-1+deb8u8","2.3-1+deb8u9"]},{"source":"osv","ecosystem":"Debian:9","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4-1+deb9u7"}]}],"versions":["2:2.4-1","2:2.4-1+deb9u1","2:2.4-1+deb9u2","2:2.4-1+deb9u3","2:2.4-1+deb9u4","2:2.4-1+deb9u6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0-3ubuntu2","1.0-3ubuntu3","1.0-3ubuntu4","2.1-0ubuntu1","2.1-0ubuntu1.1","2.1-0ubuntu1.2","2.1-0ubuntu1.3","2.1-0ubuntu1.4","2.1-0ubuntu1.5","2.1-0ubuntu1.6","2.1-0ubuntu1.7","2.1-0ubuntu1.7+esm1","2.1-0ubuntu1.7+esm2","2.1-0ubuntu1.7+esm3","2.1-0ubuntu1.7+esm4","2.1-0ubuntu1.7+esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-0ubuntu3","2.4-0ubuntu4","2.4-0ubuntu5","2.4-0ubuntu6","2.4-0ubuntu6.2","2.4-0ubuntu6.3","2.4-0ubuntu6.4","2.4-0ubuntu6.5","2.4-0ubuntu6.6","2.4-0ubuntu6.7","2.4-0ubuntu6.8","2.4-0ubuntu6.8+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-1.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"w1.fi","product":"hostapd"}],"references":[{"url":"https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2020/02/27/1","tags":["mailing-list","x_refsource_MLIST","x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2020/02/27/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2020/Feb/26","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00010.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10064"},{"url":"https://github.com/advisories/GHSA-h5p7-cpc2-2j2r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10064","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10064","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/02/27/1","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/02/27/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10064","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37660","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-10064","description":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.","status":"published","published":"2020-02-28T14:07:14Z","modified":"2024-08-04T22:10:09.43Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-2125","description":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.","status":"published","published":"2020-02-28T14:07:14Z","modified":"2024-08-04T22:10:09Z","updated_at":"2026-11-03T02:40:54.154728Z"}],"ghsa":[{"id":"GHSA-h5p7-cpc2-2j2r","title":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library...","description":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.","status":"published","published":"2022-05-24T17:09:53Z","modified":"2023-01-29T05:01:40Z","cwes":["CWE-331"],"updated_at":"2026-11-02T14:44:53.095202Z"}],"nvd":[{"id":"CVE-2019-10064","description":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.","status":"published","published":"2020-02-28T15:15:11.993Z","modified":"2026-06-17T02:10:08.463Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"CVE-2019-10064","description":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.","status":"published","published":"2020-02-28T15:15:11.993Z","modified":"2026-11-04T17:27:21.785689911Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T17:42:10.252324Z"},{"id":"DEBIAN-CVE-2019-10064","description":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.","status":"published","published":"2020-02-28T15:15:11.993Z","modified":"2026-09-21T07:00:48.617904846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2019-10064","description":"hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.","status":"published","published":"2020-02-28T15:15:00Z","modified":"2025-10-24T04:47:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DLA-2138-1","title":"wpa - security update","status":"published","published":"2020-03-10T00:00:00Z","modified":"2026-03-09T01:23:29.286889Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2318-1","title":"wpa - security update","status":"published","published":"2020-08-09T00:00:00Z","modified":"2026-03-09T01:20:06.561032Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"openSUSE-SU-2026:12398-1","title":"hostapd-2.12-1.1 on GA media","description":"These are all security issues fixed in the hostapd-2.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T17:23:21.433326008Z","updated_at":"2026-11-04T17:43:22.558805Z"}]}}