Control: tags -1 + moreinfo d-i On Thu, 2018-08-09 at 09:31 +0200, Andrej Shadura wrote: > I would like to fix CVE-2018-14526 (#905739) in stable: > > CVE-2018-14526[0]: > > An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 > > through 2.6. Under certain conditions, the integrity of EAPOL-Key > > messages is not checked, leading to a decryption oracle. An > > attacker > > within range of the Access Point and client can abuse the > > vulnerability to recover sensitive information. > > This is a low priority security issue, and doesn't require a DSA. > > [0] https://security-tracker.debian.org/tracker/CVE-2018-14526
As wpa builds a udeb, this will need a KiBi-ack; CCing and tagging accordingly. Regards, Adam
