CVE-2019-9499

The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built
against a crypto library missing explicit validation on imported elements,
do not validate the scalar and element values in EAP-pwd-Commit. An
attacker may complete authentication, session key and control of the data
connection with a client. Both hostapd with SAE support and wpa_supplicant
with SAE support prior to and including version 2.4 are affected. Both
hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior
to and including version 2.7 are affected.