Description
hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High
Affected Packages1 packages
Also affects: Debian Linux 8.0, 9.0
🔴Vulnerability Details
3GHSAGHSA-h5p7-cpc2-2j2r: hostapd before 2↗2022-05-24 OSVCVE-2019-10064: hostapd before 2↗2020-02-28 CVEListCVE-2019-10064: hostapd before 2↗2020-02-28 📋Vendor Advisories
2Red Hathostapd: Not preventig the use of low quality PRNG in EAP mode leads to insufficient entropy↗2020-02-27 DebianCVE-2019-10064: wpa - hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard...↗2019 💬Community
2BugzillaCVE-2019-10064 hostapd: Not preventig the use of low quality PRNG in EAP mode leads to insufficient entropy↗2020-03-06 BugzillaCVE-2016-10743 hostapd: Not preventig the use of low quality PRNG leads to insufficient entropy↗2020-03-06