Homepage

Use of Insufficiently Random Values Affecting wpa_supplicant package, versions <1:2.6-5.el7_4.1

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
1.74% (77th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE7-WPASUPPLICANT-2520182
  • published10 Apr 2022
  • disclosed17 Oct 2017
Report a new vulnerability Found a mistake?

Introduced: 17 Oct 2017

CVE-2017-13087  (opens in a new tab)
CWE-330  (opens in a new tab)

How to fix?

Upgrade Oracle:7 wpa_supplicant to version 1:2.6-5.el7_4.1 or higher.
This issue was patched in ELSA-2017-2907.

NVD Description

Note: Versions mentioned in the description apply only to the upstream wpa_supplicant package and not the wpa_supplicant package as distributed by Oracle. See How to fix? for Oracle:7 relevant fixed versions and status.

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

References