Bug#905762: stretch-pu: package wpa/2:2.4-1+deb9u2

["Adam D. Barratt" <adam@adam-barratt.org.uk>]

Control: tags -1 + moreinfo d-i

On Thu, 2018-08-09 at 09:31 +0200, Andrej Shadura wrote:
> I would like to fix CVE-2018-14526 (#905739) in stable:
> 
> CVE-2018-14526[0]:
> > An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0
> > through 2.6. Under certain conditions, the integrity of EAPOL-Key
> > messages is not checked, leading to a decryption oracle. An
> > attacker
> > within range of the Access Point and client can abuse the
> > vulnerability to recover sensitive information.
> 
> This is a low priority security issue, and doesn't require a DSA.
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2018-14526

As wpa builds a udeb, this will need a KiBi-ack; CCing and tagging
accordingly.

Regards,

Adam