CVE-2019-11555

The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state…

published April 26, 2019

CVSS
—
EPSS
3%
Percentile
88.3
In the wild
Unconfirmed
What it is

The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03252 · 88.3th percentile
Published
2019-04-26T21:16Z
EPSS history
Timeline
  • 26 APR 21:16Z
    The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state…
    cvelistv5