PT-2021-3060 · Openbsd · Openbsd

Mathy Vanhoef · Published 2021-05-11 · Updated 2022-04-29 · CVE-2020-26142

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenBSD version 6.6

Description An issue was discovered in the kernel where the WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. This allows an adversary to inject arbitrary network packets, independent of the network configuration. The vulnerability exists due to the lack of measures to neutralize special elements in the implementation of these algorithms.

Recommendations For OpenBSD version 6.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2021-02667

CVE-2020-26142

OESA-2022-1621

Affected Products

Openbsd

References · 39

• https://nvd.nist.gov/vuln/detail/CVE-2021-39698 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1055 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-26142 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1016 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27666 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39713 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28390 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-9459.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20009 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23040 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1198 · Security Note