Security Vulnerabilities Section Needed in your forum...

[mcc85]

***GOT REQUEST TO AUDIT SECURITY***
Fetching vuln.xml.bz2: .......... done
py27-yaml-3.13 is vulnerable:
py-yaml -- arbitrary code execution
CVE: CVE-2017-18342
WWW: https://vuxml.FreeBSD.org/freebsd/f6ea18bb-65b9-11e9-8b31-002590045d9c.html

hostapd-2.7_1 is vulnerable:
FreeBSD -- EAP-pwd side-channel attack
CVE: CVE-2019-9495
WWW: https://vuxml.FreeBSD.org/freebsd/60129efe-656d-11e9-8e67-206a8a720317.html

hostapd-2.7_1 is vulnerable:
FreeBSD -- SAE confirm missing state validation
CVE: CVE-2019-9496
WWW: https://vuxml.FreeBSD.org/freebsd/98b71436-656d-11e9-8e67-206a8a720317.html

hostapd-2.7_1 is vulnerable:
FreeBSD -- EAP-pwd message reassembly issue with unexpected fragment
WWW: https://vuxml.FreeBSD.org/freebsd/a207bbd8-6572-11e9-8e67-206a8a720317.html

hostapd-2.7_1 is vulnerable:
FreeBSD -- SAE side-channel attacks
CVE: CVE-2019-9494
WWW: https://vuxml.FreeBSD.org/freebsd/7e53f9cc-656d-11e9-8e67-206a8a720317.html

hostapd-2.7_1 is vulnerable:
FreeBSD -- EAP-pwd missing commit validation
CVE: CVE-2019-9499
CVE: CVE-2019-9498
CVE: CVE-2019-9497
WWW: https://vuxml.FreeBSD.org/freebsd/2da3cb25-6571-11e9-8e67-206a8a720317.html

wpa_supplicant-2.7 is vulnerable:
FreeBSD -- SAE confirm missing state validation
CVE: CVE-2019-9496
WWW: https://vuxml.FreeBSD.org/freebsd/98b71436-656d-11e9-8e67-206a8a720317.html

wpa_supplicant-2.7 is vulnerable:
FreeBSD -- SAE side-channel attacks
CVE: CVE-2019-9494
WWW: https://vuxml.FreeBSD.org/freebsd/7e53f9cc-656d-11e9-8e67-206a8a720317.html

wpa_supplicant-2.7 is vulnerable:
FreeBSD -- EAP-pwd side-channel attack
CVE: CVE-2019-9495
WWW: https://vuxml.FreeBSD.org/freebsd/60129efe-656d-11e9-8e67-206a8a720317.html

wpa_supplicant-2.7 is vulnerable:
FreeBSD -- EAP-pwd missing commit validation
CVE: CVE-2019-9499
CVE: CVE-2019-9498
CVE: CVE-2019-9497
WWW: https://vuxml.FreeBSD.org/freebsd/2da3cb25-6571-11e9-8e67-206a8a720317.html

wpa_supplicant-2.7 is vulnerable:

[franco]

Err, thank you for posting random audit info. The audit scanner is for you personally and not to let us know there are reported security issues because we are aware (after all we use the scanner we built as well) and there will be updates eventually.


Cheers,
Franco