---

CVE-2018-14526 - log back

CVE-2018-14526 created at 25 Sep 2019 19:31:40
Severity	+ High
Remote	+ Remote
Type	+ Information disclosure
Description	+ An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.
References	+ https://papers.mathyvanhoef.com/woot2018.pdf + https://securitytracker.com/id/1041438 + https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt
Notes