==========================================================================
Ubuntu Security Notice USN-4098-1
August 14, 2019

wpa vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.04
– Ubuntu 18.04 LTS

Summary:

wpa_supplicant and hostapd could be made to expose sensitive information
over the network.

Software Description:
– wpa: client support for WPA and WPA2

Details:

It was discovered that wpa_supplicant and hostapd were vulnerable to a side
channel attack against EAP-pwd. A remote attacker could possibly use this
issue to recover certain passwords.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
hostapd 2:2.6-21ubuntu3.2
wpasupplicant 2:2.6-21ubuntu3.2

Ubuntu 18.04 LTS:
hostapd 2:2.6-15ubuntu2.4
wpasupplicant 2:2.6-15ubuntu2.4

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://usn.ubuntu.com/4098-1
CVE-2019-13377

Package Information:
https://launchpad.net/ubuntu/+source/wpa/2:2.6-21ubuntu3.2
https://launchpad.net/ubuntu/+source/wpa/2:2.6-15ubuntu2.4

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl1UE3MACgkQZWnYVadE
vpN1XxAAladiuZg9RpBtxZsZo5J2mc47l6Euh7WeJrfzzMFtQH4wbR7g+LN3n1V2
hVvuLGWQPq0k4nnxTUOdU0a0t6wju3fMVCisolrIt8jeitj9gfbMc1P/jXdFRPIr
YAv+RXp7Emfp4ARVixfUTzoibCc4cJRzkxC5lSSmIoxiNhnEqPZmx0clrLcpmv3E
xEOBGVncvYxf8phWOQBrF7bMIZeUghUdgd+ZNDhwivbTLTn9AkAQc4pXBYQJSv81
v8R48ovsX5hV2ScmyAsiQXDMnhedZTUAOYa7ukYE2fz7CJQMI9fRW2U5/HisZSli
es3CiSjCjUpeqY83JZuITAGRZ3Id5cfg7CARImaMQ1V5k6afEipbbhBPzYZpPNZW
DknVCARIpu57nHNphTW/BbHzL360RgIko3xr700r+vCn3r/auniBiH8ghy5UB8Ib
A1CT93zoZZTzplbLrIBLyaZ42XCgNUAIsGuMAY12+C8yyWzroOaJq1m1ninDCUnl
gTpQsT9t9E3GDA1zRqOIxcM6tJwLg8RgKqNwkG92KHk6LsnFAlP9tEFfa97jvpZo
iJ6aeyR94wmowGlQTxoHyRKEYm4B5HhJ4vkqa69JN4gZDlgFFZtD9s0dfVtVxhmS
LmrxSAVgYQA/kgh+sZsikFMCXvbaSOmz5us007XWMvcceDAGaYg=
=XH5C
—–END PGP SIGNATURE—–
—