Hi Adam, Adam D. Barratt <adam@adam-barratt.org.uk> (2018-08-17): > Control: tags -1 + moreinfo d-i > > On Thu, 2018-08-09 at 09:31 +0200, Andrej Shadura wrote: > > I would like to fix CVE-2018-14526 (#905739) in stable: > > > > CVE-2018-14526[0]: > > > An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 > > > through 2.6. Under certain conditions, the integrity of EAPOL-Key > > > messages is not checked, leading to a decryption oracle. An > > > attacker > > > within range of the Access Point and client can abuse the > > > vulnerability to recover sensitive information. > > > > This is a low priority security issue, and doesn't require a DSA. > > > > [0] https://security-tracker.debian.org/tracker/CVE-2018-14526 > > As wpa builds a udeb, this will need a KiBi-ack; CCing and tagging > accordingly. No objections. Not sure whether you wanted to +confirm it, so I'll leave tagging up to you. Cheers, -- Cyril Brulebois (kibi@debian.org) <https://debamax.com/> D-I release manager -- Release team member -- Freelance Consultant
Attachment:
signature.asc
Description: PGP signature