CVE-2016-10743 hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wpa(Debian:12) | < 2:2.6-7 | 2:2.6-7 |
| debian/wpa(Debian:13) | < 2:2.6-7 | 2:2.6-7 |
| debian/wpa(Debian:14) | < 2:2.6-7 | 2:2.6-7 |
| w1.fi hostapd | < 2.6 | 2.6 |
References
- Debian Security Tracker CVE-2016-10743 vendor-advisory
- packetstormsecurity.com
- 20200227 Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) mailing-list
- [oss-security] 20200227 Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) mailing-list
- [oss-security] 20200227 Re: Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) mailing-list
- [debian-lts-announce] 20190328 [SECURITY] [DLA 1733-1] wpa security update mailing-list
- USN-3944-1 vendor-advisory
- w1.fi patch third-party-advisory