linux/meta-openembedded.git/meta-oe/recipes-connectivity/hostapd, branch scarthgap

hostapd: patch CVE-2022-37660

2025-11-12T05:44:57+00:00

Pick patches according to oe-core patch for this CVE in wpa-supplicant. Leave out commit which patched only files not present in hostapd. Note that Debian just picked the last commit (actually fixing the CVE) and removed not-applicable parts, but it is probably better to be consistent with oe-core status. Signed-off-by: Peter Marko Signed-off-by: Anuj Mittal

hostapd: patch CVE-2025-24912

2025-10-30T07:11:04+00:00

Details https://nvd.nist.gov/vuln/detail/CVE-2025-24912 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

hostapd: Add CVE id to CVE-2024-3596_00.patch

2025-01-21T00:45:33+00:00

Signed-off-by: Robert Yang Signed-off-by: Armin Kuster

hostapd: Security fix for CVE-2023-52160

2024-12-15T18:52:28+00:00

CVE-2023-52160: The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-52160 Patch from: https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439c Signed-off-by: Yi Zhao Signed-off-by: Armin Kuster

hostapd: Patch security advisory 2024-2

2024-10-06T11:27:47+00:00

Pick patches according to http://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt SAE H2E and incomplete downgrade protection for group negotiation Patch 0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch was removed as it only patched wpa_supplicant. The patch names were not changed so it is comparable with wpa_supplicant recipe. Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

hostapd: Patch CVE-2024-3596

2024-10-06T11:27:43+00:00

Picked patches according to http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt First patch is style commit picked to have a clean cherry-pick of all mentioned commits without any conflict. Patch CVE-2024-3596_03.patch was removed as it only patched wpa_supplicant. The patch names were not changed so it is comparable with wpa_supplicant recipe. Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

hostapd: Only include the relevant parts from README in LIC_FILES_CHKSUM

2024-08-14T14:19:24+00:00

Only include the lines from the README that cover the copyright and the license text. License-Update: Only include the relevant parts of the README Signed-off-by: Peter Kjellerstedt Signed-off-by: Armin Kuster

hostapd: Support running "devtool modify hostapd"

2024-08-14T14:18:47+00:00

For "devtool modify" to work correctly, ${B} needs to match ${S}. Signed-off-by: Peter Kjellerstedt Signed-off-by: Armin Kuster

hostapd: upgrade 2.9 -> 2.10

2022-01-25T18:56:04+00:00

0001-Prepare-for-CVE-2021-30004.patch.patch CVE-2019-16275.patch CVE-2019-5061.patch CVE-2021-0326.patch CVE-2021-27803.patch CVE-2021-30004.patch removed since they're included in 2.10 License-Update: year updated to 2022. Changelog: ========= * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added option send SAE Confirm immediately (sae_config_immediate=1) after SAE Commit - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2) - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed WPS UPnP SUBSCRIBE handling of invalid operations [https://w1.fi/security/2020-1/] * fixed PMF disconnection protection bypass [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * fixed various issues in experimental support for EAP-TEAP server * added configuration (max_auth_rounds, max_auth_rounds_short) to increase the maximum number of EAP message exchanges (mainly to support cases with very large certificates) for the EAP server * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * extended HE (IEEE 802.11ax) support, including 6 GHz support * removed obsolete IAPP functionality * fixed EAP-FAST server with TLS GCM/CCM ciphers * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible; owe_ptk_workaround=1 can be used to enabled a a workaround for the group 20/21 backwards compatibility * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * added support for PASN * added EAP-TLS server support for TLS 1.3 (disabled by default for now) * a large number of other fixes, cleanup, and extensions Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

Convert to new override syntax

2021-08-03T17:21:25+00:00

This is the result of automated script (0.9.1) conversion: oe-core/scripts/contrib/convert-overrides.py . converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Martin Jansa