{"id":"CVE-2019-9496","aliases":["ALPINE-CVE-2019-9496","DEBIAN-CVE-2019-9496","EUVD-2019-18870","GHSA-cvwc-47mg-vx9r","openSUSE-SU-2020:0222-1","openSUSE-SU-2024:10846-1"],"status":"published","title":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps","description":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04631,"percentile":0.91769,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-642"],"published":"2019-04-17T13:31:08Z","modified":"2026-09-21T07:01:35Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"hostapd","fixed_in":["2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"hostapd","fixed_in":["2.6-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"hostapd","fixed_in":["2.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"hostapd","fixed_in":["2.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"hostapd","fixed_in":["2.7-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wpa","fixed_in":["2:2.7+git20190128+0c1e29f-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wpa","fixed_in":["2:2.7+git20190128+0c1e29f-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wpa","fixed_in":["2:2.7+git20190128+0c1e29f-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.7+git20190128+0c1e29f-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.7+git20190128+0c1e29f-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.7+git20190128+0c1e29f-4"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-bp151.5.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-bp151.5.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-bp151.5.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-6.2"}]}],"bundled":11}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"w1.fi","product":"hostapd"},{"vendor":"w1.fi","product":"wpa_supplicant"},{"vendor":"wi-fi alliance","product":"hostapd with sae support"},{"vendor":"wi-fi alliance","product":"wpa_supplicant with sae support"}],"references":[{"url":"https://w1.fi/security/2019-3/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_16","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDOZGR3T7FVO5JSZWK2QPR7AOFIEJTIZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVMJOFEYBGXZLFF5IOLW67SSOPKFEJP3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-19:03.wpa.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","advisory"]},{"url":"https://seclists.org/bugtraq/2019/May/40","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9496"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVMJOFEYBGXZLFF5IOLW67SSOPKFEJP3/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDOZGR3T7FVO5JSZWK2QPR7AOFIEJTIZ/"},{"url":"https://github.com/advisories/GHSA-cvwc-47mg-vx9r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9496","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9496","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q7B4Y5BPIVXIPXUAQX744IATOJBYNYP6/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056061","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9499","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30004","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-9496","title":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps","description":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.","status":"published","published":"2019-04-17T13:31:08Z","modified":"2024-08-04T21:54:44.155Z","cwes":["CWE-642"],"updated_at":"2026-11-02T14:20:20.397093Z"}],"euvd":[{"id":"EUVD-2019-18870","description":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.","status":"published","published":"2019-04-17T13:31:08Z","modified":"2024-08-04T21:54:44Z","updated_at":"2026-11-03T03:06:38.242317Z"}],"ghsa":[{"id":"GHSA-cvwc-47mg-vx9r","title":"An invalid authentication sequence could result in the hostapd process terminating due to missing...","description":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.","status":"published","published":"2022-05-14T01:01:39Z","modified":"2023-02-02T05:03:07Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:51:34.49846Z"}],"nvd":[{"id":"CVE-2019-9496","description":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.","status":"published","published":"2019-04-17T14:29:03.917Z","modified":"2026-06-17T02:43:49.203Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-642","CWE-287"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"ALPINE-CVE-2019-9496","description":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.","status":"published","published":"2019-04-17T14:29:03.917Z","modified":"2026-09-21T06:17:52.554794118Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2019-9496","description":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.","status":"published","published":"2019-04-17T14:29:03.917Z","modified":"2026-03-15T22:29:54.653832Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-9496","description":"An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.","status":"published","published":"2019-04-17T14:29:03.917Z","modified":"2026-09-21T07:01:35.922820798Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"openSUSE-SU-2020:0222-1","title":"Security update for hostapd","description":"This update for hostapd fixes the following issues:\n\nhostapd was updated to version 2.9:\n\n* SAE changes\n  - disable use of groups using Brainpool curves\n  - improved protection against side channel attacks\n    [https://w1.fi/security/2019-6/]\n* EAP-pwd changes\n  - disable use of groups using Brainpool curves\n  - improved protection against side channel attacks\n  [https://w1.fi/security/2019-6/]\n* fixed FT-EAP initial mobility domain association using PMKSA caching\n* added configuration of airtime policy\n* fixed FILS to and RSNE into (Re)Association Response frames\n* fixed DPP bootstrapping URI parser of channel list\n* added support for regulatory WMM limitation (for ETSI)\n* added support for MACsec Key Agreement using IEEE 802.1X/PSK\n* added experimental support for EAP-TEAP server (RFC 7170)\n* added experimental support for EAP-TLS server with TLS v1.3\n* added support for two server certificates/keys (RSA/ECC)\n* added AKMSuiteSelector into 'STA \u003caddr\u003e' control interface data to\n  determine with AKM was used for an association\n* added eap_sim_id parameter to allow EAP-SIM/AKA server pseudonym and\n  fast reauthentication use to be disabled\n* fixed an ECDH operation corner case with OpenSSL\n\nUpdate to version 2.8\n* SAE changes\n  - added support for SAE Password Identifier\n  - changed default configuration to enable only group 19\n    (i.e., disable groups 20, 21, 25, 26 from default configuration) and\n    disable all unsuitable groups completely based on REVmd changes\n  - improved anti-clogging token mechanism and SAE authentication\n    frame processing during heavy CPU load; this mitigates some issues\n    with potential DoS attacks trying to flood an AP with large number\n    of SAE messages\n  - added Finite Cyclic Group field in status code 77 responses\n  - reject use of unsuitable groups based on new implementation guidance\n    in REVmd (allow only FFC groups with prime \u003e= 3072 bits and ECC\n    groups with prime \u003e= 256)\n  - minimize timing and memory use differences in PWE derivation\n    [https://w1.fi/security/2019-1/] (CVE-2019-9494)\n  - fixed confirm message validation in error cases\n    [https://w1.fi/security/2019-3/] (CVE-2019-9496)\n* EAP-pwd changes\n  - minimize timing and memory use differences in PWE derivation\n    [https://w1.fi/security/2019-2/] (CVE-2019-9495)\n  - verify peer scalar/element\n    [https://w1.fi/security/2019-4/] (CVE-2019-9497 and CVE-2019-9498)\n  - fix message reassembly issue with unexpected fragment\n    [https://w1.fi/security/2019-5/]\n  - enforce rand,mask generation rules more strictly\n  - fix a memory leak in PWE derivation\n  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and\n    27)\n* Hotspot 2.0 changes\n  - added support for release number 3\n  - reject release 2 or newer association without PMF\n* added support for RSN operating channel validation\n  (CONFIG_OCV=y and configuration parameter ocv=1)\n* added Multi-AP protocol support\n* added FTM responder configuration\n* fixed build with LibreSSL\n* added FT/RRB workaround for short Ethernet frame padding\n* fixed KEK2 derivation for FILS+FT\n* added RSSI-based association rejection from OCE\n* extended beacon reporting functionality\n* VLAN changes\n  - allow local VLAN management with remote RADIUS authentication\n  - add WPA/WPA2 passphrase/PSK -based VLAN assignment\n* OpenSSL: allow systemwide policies to be overridden\n* extended PEAP to derive EMSK to enable use with ERP/FILS\n* extended WPS to allow SAE configuration to be added automatically\n  for PSK (wps_cred_add_sae=1)\n* fixed FT and SA Query Action frame with AP-MLME-in-driver cases\n* OWE: allow Diffie-Hellman Parameter element to be included with DPP\n  in preparation for DPP protocol extension\n* RADIUS server: started to accept ERP keyName-NAI as user identity\n  automatically without matching EAP database entry\n* fixed PTK rekeying with FILS and FT\n\nwpa_supplicant:\n* SAE changes\n  - added support for SAE Password Identifier\n  - changed default configuration to enable only groups 19, 20, 21\n    (i.e., disable groups 25 and 26) and disable all unsuitable groups\n    completely based on REVmd changes\n  - do not regenerate PWE unnecessarily when the AP uses the\n    anti-clogging token mechanisms\n  - fixed some association cases where both SAE and FT-SAE were enabled\n    on both the station and the selected AP\n  - started to prefer FT-SAE over SAE AKM if both are enabled\n  - started to prefer FT-SAE over FT-PSK if both are enabled\n  - fixed FT-SAE when SAE PMKSA caching is used\n  - reject use of unsuitable groups based on new implementation guidance\n    in REVmd (allow only FFC groups with prime \u003e= 3072 bits and ECC\n    groups with prime \u003e= 256)\n  - minimize timing and memory use differences in PWE derivation\n    [https://w1.fi/security/2019-1/] (CVE-2019-9494)\n* EAP-pwd changes\n  - minimize timing and memory use differences in PWE derivation\n    [https://w1.fi/security/2019-2/] (CVE-2019-9495)\n  - verify server scalar/element\n    [https://w1.fi/security/2019-4/] (CVE-2019-9499)\n  - fix message reassembly issue with unexpected fragment\n    [https://w1.fi/security/2019-5/]\n  - enforce rand,mask generation rules more strictly\n  - fix a memory leak in PWE derivation\n  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and\n    27)\n* fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y\n* Hotspot 2.0 changes\n  - do not indicate release number that is higher than the one\n    AP supports\n  - added support for release number 3\n  - enable PMF automatically for network profiles created from\n    credentials\n* fixed OWE network profile saving\n* fixed DPP network profile saving\n* added support for RSN operating channel validation\n  (CONFIG_OCV=y and network profile parameter ocv=1)\n* added Multi-AP backhaul STA support\n* fixed build with LibreSSL\n* number of MKA/MACsec fixes and extensions\n* extended domain_match and domain_suffix_match to allow list of values\n* fixed dNSName matching in domain_match and domain_suffix_match when\n  using wolfSSL\n* started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both\n  are enabled\n* extended nl80211 Connect and external authentication to support\n  SAE, FT-SAE, FT-EAP-SHA384\n* fixed KEK2 derivation for FILS+FT\n* extended client_cert file to allow loading of a chain of PEM\n  encoded certificates\n* extended beacon reporting functionality\n* extended D-Bus interface with number of new properties\n* fixed a regression in FT-over-DS with mac80211-based drivers\n* OpenSSL: allow systemwide policies to be overridden\n* extended driver flags indication for separate 802.1X and PSK\n  4-way handshake offload capability\n* added support for random P2P Device/Interface Address use\n* extended PEAP to derive EMSK to enable use with ERP/FILS\n* extended WPS to allow SAE configuration to be added automatically\n  for PSK (wps_cred_add_sae=1)\n* removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)\n* extended domain_match and domain_suffix_match to allow list of values\n* added a RSN workaround for misbehaving PMF APs that advertise\n  IGTK/BIP KeyID using incorrect byte order\n* fixed PTK rekeying with FILS and FT\n\n- Enabled CLI editing and history support.\n\nUpdate to version 2.7\n\n* fixed WPA packet number reuse with replayed messages and key\n  reinstallation\n  [http://w1.fi/security/2017-1/] (CVE-2017-13082) (boo#1056061)\n* added support for FILS (IEEE 802.11ai) shared key authentication\n* added support for OWE (Opportunistic Wireless Encryption, RFC 8110;\n  and transition mode defined by WFA)\n* added support for DPP (Wi-Fi Device Provisioning Protocol)\n* FT:\n  - added local generation of PMK-R0/PMK-R1 for FT-PSK\n    (ft_psk_generate_local=1)\n  - replaced inter-AP protocol with a cleaner design that is more\n    easily extensible; this breaks backward compatibility and requires\n    all APs in the ESS to be updated at the same time to maintain FT\n    functionality\n  - added support for wildcard R0KH/R1KH\n  - replaced r0_key_lifetime (minutes) parameter with\n    ft_r0_key_lifetime (seconds)\n  - fixed wpa_psk_file use for FT-PSK\n  - fixed FT-SAE PMKID matching\n  - added expiration to PMK-R0 and PMK-R1 cache\n  - added IEEE VLAN support (including tagged VLANs)\n  - added support for SHA384 based AKM\n* SAE\n  - fixed some PMKSA caching cases with SAE\n  - added support for configuring SAE password separately of the\n    WPA2 PSK/passphrase\n  - added option to require MFP for SAE associations\n    (sae_require_pmf=1)\n  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection\n    for SAE;\n    note: this is not backwards compatible, i.e., both the AP and\n    station side implementations will need to be update at the same\n    time to maintain interoperability\n  - added support for Password Identifier\n* hostapd_cli: added support for command history and completion\n* added support for requesting beacon report\n* large number of other fixes, cleanup, and extensions\n* added option to configure EAPOL-Key retry limits\n  (wpa_group_update_count and wpa_pairwise_update_count)\n* removed all PeerKey functionality\n* fixed nl80211 AP mode configuration regression with Linux 4.15 and\n  newer\n* added support for using wolfSSL cryptographic library\n* fixed some 20/40 MHz coexistence cases where the BSS could drop to\n  20 MHz even when 40 MHz would be allowed\n* Hotspot 2.0\n  - added support for setting Venue URL ANQP-element (venue_url)\n  - added support for advertising Hotspot 2.0 operator icons\n  - added support for Roaming Consortium Selection element\n  - added support for Terms and Conditions\n  - added support for OSEN connection in a shared RSN BSS\n* added support for using OpenSSL 1.1.1\n* added EAP-pwd server support for salted passwords\n\n","status":"published","published":"2020-02-15T19:10:10Z","modified":"2026-02-04T03:44:46.483416Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10846-1","title":"hostapd-2.9-6.2 on GA media","description":"These are all security issues fixed in the hostapd-2.9-6.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:11:09.020358Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}