Authentication Bypass Affecting perf package, versions <0:4.18.0-348.el8
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS8-PERF-2139457
- published 26 Jul 2021
- disclosed 11 May 2021
Introduced: 11 May 2021
CVE-2020-26144 Open this link in a new tabHow to fix?
Upgrade Centos:8 perf to version 0:4.18.0-348.el8 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream perf package and not the perf package as distributed by Centos.
See How to fix? for Centos:8 relevant fixed versions and status.
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
- https://access.redhat.com/security/cve/CVE-2020-26144
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- https://www.fragattacks.com
- http://www.openwall.com/lists/oss-security/2021/05/11/12
- https://access.redhat.com/errata/RHSA-2021:4356
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63