Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2022-23304

critique

CVE-2022-23304

wpa_supplicant: EAP-pwd side-channel attacks as a result of cache access patterns

Publiée Modifiée CWE 203
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon NVD, CBL-Mariner, Photon OS. Plus basse selon Red Hat (moyenne), Ubuntu (faible).

Description

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
CBL-Mariner 1.0wpa_supplicant0:2.10-1.cm1
CBL-Mariner 2.0wpa_supplicant0:2.10-1.cm2
Photon OS 3.0wpa_supplicant2.10-1.ph3
Photon OS 4.0wpa_supplicant2.10-1.ph4
alpine 3.12hostapd2.9-r4
alpine 3.13hostapd2.9-r4
alpine 3.14hostapd2.9-r4
alpine 3.15hostapd2.10-r0
alpine 3.16hostapd2.10-r0
alpine 3.17hostapd2.10-r0
alpine 3.18hostapd2.10-r0
alpine 3.19hostapd2.10-r0
Afficher les 33 entrées de 33 sources
SourcePaquetCorrigé en
CBL-Mariner 1.0wpa_supplicant0:2.10-1.cm1
CBL-Mariner 2.0wpa_supplicant0:2.10-1.cm2
Photon OS 3.0wpa_supplicant2.10-1.ph3
Photon OS 4.0wpa_supplicant2.10-1.ph4
alpine 3.12hostapd2.9-r4
alpine 3.13hostapd2.9-r4
alpine 3.14hostapd2.9-r4
alpine 3.15hostapd2.10-r0
alpine 3.16hostapd2.10-r0
alpine 3.17hostapd2.10-r0
alpine 3.18hostapd2.10-r0
alpine 3.19hostapd2.10-r0
alpine 3.20hostapd2.10-r0
alpine 3.21hostapd2.10-r0
alpine 3.22hostapd2.10-r0
alpine 3.23hostapd2.10-r0
alpine 3.24hostapd2.10-r0
alpine edgehostapd2.10-r0
debian 10wpapas de correctif indiqué
debian 11wpa2:2.9.0-21+deb11u3
debian 12wpa2:2.10-1
debian 13wpa2:2.10-1
debian 14wpa2:2.10-1
debian 9wpapas de correctif indiqué
echowpa2:2.10-1
rapidfort alpine 3.20wpa_supplicant2.11-r0
rapidfort alpine 3.21wpa_supplicant2.11-r0
rapidfort alpine 3.22wpa_supplicant2.11-r0
rapidfort alpine 3.23wpa_supplicant2.11-r0
rapidfort alpine 3.24wpa_supplicant2.11-r0
Red Hatwpa_supplicantpas de correctif indiqué
ubuntu 20.04wpa2:2.9-1ubuntu4.6
ubuntu 20.04-ESMwpa2:2.9-1ubuntu4.6

Références

Les 10 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.