CVE-2020-24587 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all

What is CVE-2020-24587?

CVE-2020-24587 is a low-severity vulnerability in Debian Debian Linux, published on 11 May 2021.

Official description

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.

Weakness: CWE-327

Which versions are affected by CVE-2020-24587?

It affects 168 products.

Products include Arista C-100 Firmware, Arista C-110 Firmware, Arista C-120 Firmware, Arista C-130 Firmware, Arista C-200 Firmware, Arista C-230 Firmware and 162 more.

How do I fix CVE-2020-24587?

Upgrade to a fixed version.

Is CVE-2020-24587 being exploited?

There is no known exploitation of CVE-2020-24587 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2020-26144 Other in n/a Medium 6.5
• CVE-2020-26139 Missing authorization in n/a Medium 5.3
• CVE-2020-26146 Information disclosure in n/a Medium 5.3
• CVE-2020-24588 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the Low 3.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as 2860131, 2868012, 2874366, 2875946, 2875950, A-175626671 and 4 more.