Algorithm Handling Issue in wpa_supplicant and hostapd by W1.fi
CVE-2021-30004

5.3MEDIUM

Key Information:

Vendor

W1.fi

Status
Hostapd
WPa Supplicant
Vendor
CVE Published:
2 April 2021

What is CVE-2021-30004?

In wpa_supplicant and hostapd version 2.9, a vulnerability was identified where forging attacks may be conducted due to the mishandling of AlgorithmIdentifier parameters within the tls/pkcs1.c and tls/x509v3.c files. This issue could allow attackers to manipulate secure communications, making it essential for affected users to address this vulnerability promptly.

References

https://w1.fi/cgit/hostap/commit/?id=a0541334a6394f8237a4...
https://security.gentoo.org/glsa/202309-16
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.