From owner-freebsd-security@freebsd.org Mon Aug 27 22:20:49 2018 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E6E351097B79 for ; Mon, 27 Aug 2018 22:20:48 +0000 (UTC) (envelope-from SRS0=S2hu=LK=quip.cz=000.fbsd@elsa.codelab.cz) Received: from elsa.codelab.cz (elsa.codelab.cz [94.124.105.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 72FC285AD4 for ; Mon, 27 Aug 2018 22:20:48 +0000 (UTC) (envelope-from SRS0=S2hu=LK=quip.cz=000.fbsd@elsa.codelab.cz) Received: from elsa.codelab.cz (localhost [127.0.0.1]) by elsa.codelab.cz (Postfix) with ESMTP id 27D3528411 for ; Tue, 28 Aug 2018 00:20:40 +0200 (CEST) Received: from illbsd.quip.test (ip-86-49-16-209.net.upcbroadband.cz [86.49.16.209]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elsa.codelab.cz (Postfix) with ESMTPSA id 3AAA02840C for ; Tue, 28 Aug 2018 00:20:39 +0200 (CEST) To: freebsd-security@freebsd.org From: Miroslav Lachman <000.fbsd@quip.cz> Subject: Was wpa_supplicant CVE-2018-14526 fixed in 10.4-p11? Message-ID: Date: Tue, 28 Aug 2018 00:20:38 +0200 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Firefox/52.0 SeaMonkey/2.49.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 22:20:49 -0000 Running pkg audit FreeBSD-10.4_11 gives me one vulnerability: # pkg audit FreeBSD-10.4_11 FreeBSD-10.4_11 is vulnerable: wpa_supplicant -- unauthenticated encrypted EAPOL-Key data CVE: CVE-2018-14526 WWW: https://vuxml.FreeBSD.org/freebsd/6bedc863-9fbe-11e8-945f-206a8a720317.html 1 problem(s) in the installed packages found. But information on the page shows it was fixed in 10.4-p10: Affected packages wpa_supplicant < 2.6_2 FreeBSD <= 10.4_10 FreeBSD <= 11.2_1 So... was it really fixed? Is there incorrect info in VuXML database file or on the web page? Kind regards Miroslav Lachman