Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 9 May 2015 20:06:59 +0300
From: Jouni Malinen <>
To: Solar Designer <>
Subject: Re: CVE request: vulnerability in wpa_supplicant and

On Thu, May 07, 2015 at 03:15:07PM +0300, Solar Designer wrote:
> On Thu, May 07, 2015 at 01:58:27PM +0200, Martin Prpic wrote:
> > Hi, I don't see a CVE assigned for this anywhere:
> >
> > "EAP-pwd missing payload length validation

> There are currently 5 sets of advisories+patches at:

> I haven't looked into this closely, but maybe Martin's request should
> be for 2015-[234] rather than only for 2015-4.

No CVE has been requested for 2015-[234] prior to this, so if there is
use for one, all three could as well be covered.

> And I'd like to see the full advisories posted in here so that they are
> preserved in the list archives, unless there's a reason not to.  Jouni?

That would be fine. My current policy is to post all the advisories on
the hostap mailing list and if I'm requesting an CVE myself, I'm also
posting the applicable advisory to oss-security.

Jouni Malinen                                            PGP id EFC895FA

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.