{
  "cveId": "CVE-2022-37660",
  "url": "https://patchblox.com/security/cve/CVE-2022-37660",
  "summary": "CVE-2022-37660 is fixed in 5 products on 1 platform, first by eapoltest 2:2.10-6ubuntu2.2, released February 11, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "eapoltest: In hostapd 2.10 and earlier, the PKEX code remains active even after asuccessful PKEX association",
  "description": "In hostapd 2.10 and earlier, the PKEX code remains active even after asuccessful PKEX association. An attacker that successfully bootstrappedpublic keys with another entity using PKEX in the past, will be able tosubvert a future bootstrapping by passively observing public keys, re-usingthe encrypting element Qi and subtracting it from the captured message M (X= M - Qi). This will result in the public ephemeral key X; the only elementrequired to subvert the PKEX association.",
  "published": "2025-02-11T15:15:00Z",
  "severity": "Medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.00378,
  "epssPercentile": 0.31962,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "eapoltest",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:2.10-6ubuntu2.2",
      "fix": "eapoltest 2:2.10-6ubuntu2.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-eapoltest-2-2.10-6ubuntu2.2",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "eapoltest",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2:2.10-21ubuntu0.2",
      "fix": "eapoltest 2:2.10-21ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-eapoltest-2-2.10-21ubuntu0.2",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "eapoltest",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2:2.10-22ubuntu0.1",
      "fix": "eapoltest 2:2.10-22ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-eapoltest-2-2.10-22ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "hostapd",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:2.9-1ubuntu4.6",
      "fix": "hostapd 2:2.9-1ubuntu4.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-hostapd-2-2.9-1ubuntu4.6",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "hostapd",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:2.10-6ubuntu2.2",
      "fix": "hostapd 2:2.10-6ubuntu2.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-hostapd-2-2.10-6ubuntu2.2",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "hostapd",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2:2.10-21ubuntu0.2",
      "fix": "hostapd 2:2.10-21ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-hostapd-2-2.10-21ubuntu0.2",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "hostapd",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2:2.10-22ubuntu0.1",
      "fix": "hostapd 2:2.10-22ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-hostapd-2-2.10-22ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "wpa",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2:2.10-12\u002Bdeb12u3",
      "fix": "DEBIAN-CVE-2022-37660",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-37660",
      "released": "2025-02-11T23:15:08Z"
    },
    {
      "platform": "linux",
      "product": "wpa",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2:2.10-24",
      "fix": "DEBIAN-CVE-2022-37660",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-37660",
      "released": "2025-02-11T23:15:08Z"
    },
    {
      "platform": "linux",
      "product": "wpa",
      "release": "Debian 14",
      "fixedVersion": "2:2.10-24",
      "fix": "DEBIAN-CVE-2022-37660",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-37660",
      "released": "2025-02-11T23:15:08Z"
    },
    {
      "platform": "linux",
      "product": "wpagui",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:2.9-1ubuntu4.6",
      "fix": "wpagui 2:2.9-1ubuntu4.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-wpagui-2-2.9-1ubuntu4.6",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "wpagui",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:2.10-6ubuntu2.2",
      "fix": "wpagui 2:2.10-6ubuntu2.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-wpagui-2-2.10-6ubuntu2.2",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "wpagui",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2:2.10-21ubuntu0.2",
      "fix": "wpagui 2:2.10-21ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-wpagui-2-2.10-21ubuntu0.2",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "wpagui",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2:2.10-22ubuntu0.1",
      "fix": "wpagui 2:2.10-22ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-wpagui-2-2.10-22ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "wpasupplicant",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:2.9-1ubuntu4.6",
      "fix": "wpasupplicant 2:2.9-1ubuntu4.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-wpasupplicant-2-2.9-1ubuntu4.6",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "wpasupplicant",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:2.10-6ubuntu2.2",
      "fix": "wpasupplicant 2:2.10-6ubuntu2.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-wpasupplicant-2-2.10-6ubuntu2.2",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "wpasupplicant",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2:2.10-21ubuntu0.2",
      "fix": "wpasupplicant 2:2.10-21ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-wpasupplicant-2-2.10-21ubuntu0.2",
      "released": "2025-02-11T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "wpasupplicant",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2:2.10-22ubuntu0.1",
      "fix": "wpasupplicant 2:2.10-22ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-wpasupplicant-2-2.10-22ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}