]> code.ossystems Code Review - openembedded-core.git/commit
wpa-supplicant: fix CVE-2021-30004
authorStefan Ghinea <stefan.ghinea@windriver.com>
Thu, 8 Apr 2021 16:43:30 +0000 (19:43 +0300)
committerAnuj Mittal <anuj.mittal@intel.com>
Fri, 23 Apr 2021 08:18:03 +0000 (16:18 +0800)
commitdecf95ad84a38b86e4e9f86a78f76535f4f22d4f
tree6e4fe86095beee181554d6e73ecc4908aed9aadd
parent07aaa526c60c6d545ca856fc3d51606b669f641c
wpa-supplicant: fix CVE-2021-30004

In wpa_supplicant and hostapd 2.9, forging attacks may occur because
AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and
tls/x509v3.c.

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-30004

Upstream patches:
https://w1.fi/cgit/hostap/commit/?id=a0541334a6394f8237a4393b7372693cd7e96f15

Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b32b671bf430b36a5547f8d822dbb760d6be47f7)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2021-30004.patch [new file with mode: 0644]
meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.9.bb