CVE-2022-37660

Publication date 11 February 2025

Last updated 5 March 2025

Ubuntu priority

Medium

Why this priority?

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.

Read the notes from the security team

Status

Package Ubuntu Release Status
wpa 24.10 oracular
Fixed 2:2.10-22ubuntu0.1
24.04 LTS noble
Fixed 2:2.10-21ubuntu0.2
22.04 LTS jammy
Fixed 2:2.10-6ubuntu2.2
20.04 LTS focal
Fixed 2:2.9-1ubuntu4.6
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes

hlibk

On bionic and earlier, WPA3 support is not present.