| Vulnerability Name: | CVE-2019-10064 (CCN-177014) | ||||||||||||
| Assigned: | 2019-03-26 | ||||||||||||
| Published: | 2020-02-27 | ||||||||||||
| Updated: | 2022-01-01 | ||||||||||||
| Summary: | hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743. | ||||||||||||
| CVSS v3 Severity: | 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) 6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
| ||||||||||||
| Vulnerability Type: | CWE-331 | ||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2019-10064 Source: MISC Type: Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html Source: FULLDISC Type: Exploit, Mailing List, Third Party Advisory 20200227 Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) Source: MLIST Type: Exploit, Mailing List, Third Party Advisory [oss-security] 20200227 Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20200227 Re: Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) Source: XF Type: UNKNOWN hostapd-cve201910064-sec-bypass(177014) Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20200311 [SECURITY] [DLA 2138-1] wpa security update Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20200808 [SECURITY] [DLA 2318-1] wpa security update Source: CCN Type: oss-sec Mailing List, Wed, 23 Oct 2013 19:30:33 -0600 Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) Source: CCN Type: oss-sec Mailing List, Thu, 27 Feb 2020 23:38:34 +0200 Re: Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) Source: MISC Type: Patch, Third Party Advisory https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389 Source: CCN Type: hostapd Web page hostapd Source: CCN Type: WhiteSource Vulnerability Database CVE-2019-10064 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||