CVE-2021-30004

EPSS 0.3%
Veröffentlicht 02.04.2021 05:15:13
Zuletzt bearbeitet 21.11.2024 06:03:13
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

W1.Fi ≫ Hostapd Version2.9

W1.Fi ≫ Wpa Supplicant Version2.9

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.3%	0.526

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://security.gentoo.org/glsa/202309-16

https://w1.fi/cgit/hostap/commit/?id=a0541334a6394f8237a4393b7372693cd7e96f15

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-30004

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-30004

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-30004

EUVD