Skip to content
OpenAdvisories
High · 7.4 CVE-2019-5062 EUVD-2019-14669GHSA-gv78-7qxh-6mj5

An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 8…

Published Dec 12, 2019 · Updated Aug 4, 2024 · Assigned by talos

Description

An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.

Affected products

VendorProductAffectedFixed
— W1.f1 hostapd version 2.6 on a Raspberry Pi. —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 wpa No fix yet —
Debian 13 wpa No fix yet —
Debian 12 wpa No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wpa No fix yet —
Ubuntu 26.04 LTS wpa No fix yet —
Ubuntu 25.10 wpa No fix yet —
Ubuntu 24.04 LTS wpa No fix yet —
Ubuntu 22.04 LTS wpa No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wpa No fix yet —
Ubuntu 18.04 LTS wpa No fix yet —
Ubuntu 16.04 LTS wpa No fix yet —
Ubuntu Pro 14.04 LTS wpa No fix yet —

References