Description
The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wi-Fi Alliance | hostapd with EAP-pwd support | 2.7 – ≤ 2.7 | — |
| Wi-Fi Alliance | wpa_supplicant with EAP-pwd support | 2.7 – ≤ 2.7 | — |
| Wi-Fi Alliance | hostapd with SAE support | 2.4 – ≤ 2.4 | — |
| Wi-Fi Alliance | wpa_supplicant with SAE support | 2.4 – ≤ 2.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wpa | 2:2.7+git20190128+0c1e29f-4 | — |
| Debian 13 | wpa | 2:2.7+git20190128+0c1e29f-4 | — |
| Debian 12 | wpa | 2:2.7+git20190128+0c1e29f-4 | — |
| Debian 9 | wpa | 2:2.4-1+deb9u3 | DSA-4430-1 |
| Debian 8 | wpa | 2.3-1+deb8u8 | DLA-1867-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | wpa | 2:2.6-15ubuntu2.2 | USN-3944-1 |
| Ubuntu 16.04 LTS | wpa | 2.4-0ubuntu6.4 | USN-3944-1 |
| Ubuntu 14.04 LTS | wpa | 2.1-0ubuntu1.7 | USN-3944-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | wpa_supplicant | 2.9-4.20.1 | SUSE-SU-2020:3380-1 |
| SLES 15 SP1 | wpa_supplicant | 2.9-4.20.1 | SUSE-SU-2020:3380-1 |
| SLES 15 | wpa_supplicant | 2.9-4.20.1 | SUSE-SU-2020:3380-1 |
| SLES 12 SP5 | wpa_supplicant | 2.9-23.3.1 | SUSE-SU-2020:3424-1 |
| SLES 12 SP4 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
| SLES 12 SP2 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
| SLES for SAP 15 | wpa_supplicant | 2.9-4.20.1 | SUSE-SU-2020:3380-1 |
| SLES for SAP 12 SP5 | wpa_supplicant | 2.9-23.3.1 | SUSE-SU-2020:3424-1 |
| SLES for SAP 12 SP4 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
| SLES for SAP 12 SP3 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
| SLE HPC 15 | wpa_supplicant | 2.9-4.20.1 | SUSE-SU-2020:3380-1 |
| SUSE Package Hub 15 SP1 | hostapd | 2.9-bp151.5.3.1 | openSUSE-SU-2020:0222-1 |
| SUSE Package Hub 15 | hostapd | 2.9-bp151.5.3.1 | openSUSE-SU-2020:0222-1 |
| SUSE OpenStack Cloud Crowbar 9 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
| SUSE OpenStack Cloud Crowbar 8 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
| SUSE OpenStack Cloud 9 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
| SUSE OpenStack Cloud 8 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
| SUSE HPE Helion OpenStack 8 | wpa_supplicant | 2.9-15.22.1 | SUSE-SU-2022:1853-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hostapd | 2.9-6.2 | openSUSE-SU-2024:10846-1 |
| openSUSE Tumbleweed | wpa_supplicant | 2.9-13.4 | openSUSE-SU-2024:11515-1 |
| openSUSE Leap 15.2 | wpa_supplicant | 2.9-lp152.8.3.1 | openSUSE-SU-2020:2059-1 |
| openSUSE Leap 15.1 | hostapd | 2.9-bp151.5.3.1 | openSUSE-SU-2020:0222-1 |
| openSUSE Leap 15.1 | wpa_supplicant | 2.9-lp151.5.10.1 | openSUSE-SU-2020:2053-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.23 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.22 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.21 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.20 | wpa_supplicant | 2.7-r2 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.18 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.17 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.16 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.15 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.14 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.13 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.12 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.11 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.10 | wpa_supplicant | 2.7-r2 | — |
| Alpine v3.9 | wpa_supplicant | 2.7-r2 | — |
Advisories 11
- DSA-4430-1 wpa - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1867-1 wpa - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3944-1 wpa vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2022:1853-1 Security update for wpa_supplicant SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10846-1 hostapd-2.9-6.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11515-1 wpa_supplicant-2.9-13.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0222-1 Security update for hostapd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3424-1 Security update for wpa_supplicant SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:2053-1 Security update for wpa_supplicant SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3380-1 Security update for wpa_supplicant SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:2059-1 Security update for wpa_supplicant SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://w1.fi/security/2019-4/
- https://www.synology.com/security/advisory/Synology_SA_19_16
- FEDORA-2019-d03bae77f5 vendor-advisory
- FEDORA-2019-f409af9fbe vendor-advisory
- FEDORA-2019-eba1109acd vendor-advisory
- FreeBSD-SA-19:03 vendor-advisory
- 20190515 FreeBSD Security Advisory FreeBSD-SA-19:03.wpa mailing-list
- http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html
- [debian-lts-announce] 20190731 [SECURITY] [DLA 1867-1] wpa security update mailing-list
- openSUSE-SU-2020:0222 vendor-advisory