Affected: AlmaLinux:9: wpa_supplicant

The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i / RSN), and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver.

Security Fix(es):

* wpa_supplicant: potential authorization bypass (CVE-2023-52160)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Affected: Alpaquita:stream: wpa_supplicant

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.

wpa_supplicant-2.10-6.1 on GA media

Security update for wpa_supplicant

Affected: Ubuntu:Pro:14.04:LTS: wpa, Ubuntu:16.04:LTS: wpa, Ubuntu:18.04:LTS: wpa, Ubuntu:20.04:LTS: wpa, Ubuntu:22.04:LTS: wpa, Ubuntu:24.04:LTS: wpa, Ubuntu:25.10: wpa, Ubuntu:26.04:LTS: wpa

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.

Ein anonymer Angreifer im angrenzenden Netzbereich kann eine Schwachstelle in wpa_supplicant ausnutzen, um die Sicherheitsmaßnahmen zu umgehen.