Are wpa_supplicant versions prior to 2.x (e.g. 0.2.x, 0.4.x, 0.6.x, 0.7.3, etc.) also vulnerable to any of the KRACK CVEs? I've looked at the source code but it's different enough from the 2.x releases that I can't immediately tell if those old releases have the same vulnerabilities, nor what it would take to develop an effective patch.
From the published paper by Mathy Vanhoef (emphasis mine):
Our key reinstallation attack against the 4-way handshake uncovered special behavior in wpa_supplicant. First, version 2.3 and lower are vulnerable to our attacks without unexpected side-effects. However, we found that version 2.4 and 2.5 install an all-zero encryption key (TK) when receiving a retransmitted message 3.
Based on this and the widespread nature of the flaw in 802.11i client implementation, I would tend to believe they are vulnerable. However I personally haven't seen any actual tests for those particular versions or reliable documentation other than that statement.