CVE-2019-9496 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2019-9496 Interim 1 33 2025-02-17T02:12:11Z current 2021-05-30T14:25:41Z 2025-02-17T02:12:11Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2019-9496 An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/kb/doc/?id=000019433 E-Mail link for TID000019433 https://www.suse.com/support/kb/doc/?id=7023818 E-Mail link for TID7023818 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q7B4Y5BPIVXIPXUAQX744IATOJBYNYP6/ E-Mail link for openSUSE-SU-2020:0222-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES for SAP Applications 11 SP3 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Server 11 SP3 LTSS SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 11 SP4-LTSS SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Package Hub 15 SUSE Package Hub 15 SP1 openSUSE Leap 15.1 openSUSE Tumbleweed hostapd-2.9-6.2 hostapd-2.9-bp150.15.1 hostapd-2.9-bp151.5.3.1 hostapd-2.9-lp151.4.3.1 wpa_supplicant hostapd-2.9-bp150.15.1 as a component of SUSE Package Hub 15 hostapd-2.9-bp151.5.3.1 as a component of SUSE Package Hub 15 SP1 hostapd-2.9-lp151.4.3.1 as a component of openSUSE Leap 15.1 hostapd-2.9-6.2 as a component of openSUSE Tumbleweed wpa_supplicant as a component of SLES for SAP Applications 11 SP3 wpa_supplicant as a component of SUSE Linux Enterprise Desktop 12 SP3 wpa_supplicant as a component of SUSE Linux Enterprise Desktop 12 SP4 wpa_supplicant as a component of SUSE Linux Enterprise High Performance Computing 12 SP4 wpa_supplicant as a component of SUSE Linux Enterprise Module for Basesystem 15 wpa_supplicant as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata wpa_supplicant as a component of SUSE Linux Enterprise Server 11 SP3 LTSS wpa_supplicant as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata wpa_supplicant as a component of SUSE Linux Enterprise Server 11 SP4 LTSS wpa_supplicant as a component of SUSE Linux Enterprise Server 11 SP4-LTSS wpa_supplicant as a component of SUSE Linux Enterprise Server 12 SP1-LTSS wpa_supplicant as a component of SUSE Linux Enterprise Server 12 SP2-LTSS wpa_supplicant as a component of SUSE Linux Enterprise Server 12 SP3 wpa_supplicant as a component of SUSE Linux Enterprise Server 12 SP4 wpa_supplicant as a component of SUSE Linux Enterprise Server 12-LTSS wpa_supplicant as a component of SUSE Linux Enterprise Server for SAP Applications 12 wpa_supplicant as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 wpa_supplicant as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected. CVE-2019-9496 SUSE Package Hub 15:hostapd-2.9-bp150.15.1 SUSE Package Hub 15 SP1:hostapd-2.9-bp151.5.3.1 openSUSE Leap 15.1:hostapd-2.9-lp151.4.3.1 openSUSE Tumbleweed:hostapd-2.9-6.2 SLES for SAP Applications 11 SP3:wpa_supplicant SUSE Linux Enterprise Desktop 12 SP3:wpa_supplicant SUSE Linux Enterprise Desktop 12 SP4:wpa_supplicant SUSE Linux Enterprise High Performance Computing 12 SP4:wpa_supplicant SUSE Linux Enterprise Module for Basesystem 15:wpa_supplicant SUSE Linux Enterprise Server 11 SP1 for Teradata:wpa_supplicant SUSE Linux Enterprise Server 11 SP3 LTSS:wpa_supplicant SUSE Linux Enterprise Server 11 SP3 for Teradata:wpa_supplicant SUSE Linux Enterprise Server 11 SP4 LTSS:wpa_supplicant SUSE Linux Enterprise Server 11 SP4-LTSS:wpa_supplicant SUSE Linux Enterprise Server 12 SP1-LTSS:wpa_supplicant SUSE Linux Enterprise Server 12 SP2-LTSS:wpa_supplicant SUSE Linux Enterprise Server 12 SP3:wpa_supplicant SUSE Linux Enterprise Server 12 SP4:wpa_supplicant SUSE Linux Enterprise Server 12-LTSS:wpa_supplicant SUSE Linux Enterprise Server for SAP Applications 12 SP2:wpa_supplicant SUSE Linux Enterprise Server for SAP Applications 12 SP4:wpa_supplicant SUSE Linux Enterprise Server for SAP Applications 12:wpa_supplicant moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H