linux/poky.git/meta/recipes-connectivity/wpa-supplicant, branch master

The poky repository master branch is no longer being updated.

2025-11-07T13:31:53+00:00

You can either: a) switch to individual clones of bitbake, openembedded-core, meta-yocto and yocto-docs b) use the new bitbake-setup You can find information about either approach in our documentation: https://docs.yoctoproject.org/ Note that "poky" the distro setting is still available in meta-yocto as before and we continue to use and maintain that. Long live Poky! Some further information on the background of this change can be found in: https://lists.openembedded.org/g/openembedded-architecture/message/2179 Signed-off-by: Richard Purdie

wpa-supplicant: patch CVE-2025-24912

2025-11-03T17:40:41+00:00

Pick patches as listed in NVD CVE report. Note that Debian lists one of the patches as introducing the vulnerability. This is against what the original report [1] says. Also the commit messages provide hints that the first patch fixes this issue and second is fixing problem with the first patch. [1] https://jvn.jp/en/jp/JVN19358384/ (From OE-Core rev: 2eed0deab456df4ef8876afe0710c9c89b41d45f) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

meta: set S to be in UNPACKDIR in recipes that explicitly set S

2025-06-20T11:07:26+00:00

(From OE-Core rev: 7321cc17ae5483f17fe9cdffea7b62acd9d9c3a2) Signed-off-by: Alexander Kanavin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

wpa-supplicant: Ignore CVE-2024-5290

2024-10-01T11:40:48+00:00

NVD CVE report [1] links Ubuntu bug [2] which has a very good description/discussion about this issue. It applies only to distros patching wpa-supplicant to allow non-root users (e.g. via netdev group) to load modules. This is not the case of Yocto. Quote: So upstream isn't vulnerable as they only expose the dbus interface to root. Downstreams like Ubuntu and Chromium added a patch that grants access to the netdev group. The patch is the problem, not the upstream code IMHO. There is also a commit [3] associated with this CVE, however that only provides build-time configuration to limit paths which can be accessed but it acts only as a mitigation for distros which allow non-root users to load crafted modules. The patch is included in version 2.11, however NVD has this CVE version-less, so explicit ignore is necessary. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-5290 [2] https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613 [3] https://w1.fi/cgit/hostap/commit/?id=c84388ee4c66bcd310db57489eac4a75fc600747 (From OE-Core rev: 6cb794d44a8624784ec0f76dca764616d81ffbf5) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

wpa-supplicant: add patch to check for kernel header version when compiling macsec

2024-09-17T11:16:01+00:00

When using Arm binary toolchain, version 2.11 of wpa-supplicant is failing to compile with the following error: | ../src/drivers/driver_macsec_linux.c:81:29: error: field ‘offload’ has incomplete type | 81 | enum macsec_offload offload; | | Backport a recent patch that corrects the issue by adding a check for the version of kernel headers being used in compilation and disabling that enum if too old a version is being used (or is used by the binary toolchain). (From OE-Core rev: 373d8d4f5316416d70eb2c0733d9838e57419ac3) Signed-off-by: Jon Mason Signed-off-by: Richard Purdie

wpa-supplicant: Upgrade 2.10 -> 2.11

2024-08-23T21:43:27+00:00

License-Update: =============== - README: Change in copyright years as per https://w1.fi/cgit/hostap/commit/README?id=d945ddd368085f255e68328f2d3b020ceea359af - wpa_supplicant/wpa_supplicant.c: Change in copyright years as per https://w1.fi/cgit/hostap/commit/wpa_supplicant/wpa_supplicant.c?id=d945ddd368085f255e68328f2d3b020ceea359af CVE's Fixed: =========== - CVE-2024-5290 wpa_supplicant: wpa_supplicant loading arbitrary shared objects allowing privilege escalation - CVE-2023-52160 wpa_supplicant: potential authorization bypass Changes between 2.10 -> 2.11: ============================ https://w1.fi/cgit/hostap/commit/wpa_supplicant/ChangeLog?id=d945ddd368085f255e68328f2d3b020ceea359af Note: ===== Patches 0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch, 0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch, 0001-Install-wpa_passphrase-when-not-disabled.patch, 0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch (CVE-2023-52160) are already fixed and hence removing them. (From OE-Core rev: 824eb0641dc6001a5e9ad7a685e60c472c9fdce8) Signed-off-by: Siddharth Doshi Signed-off-by: Richard Purdie

recipes: Update WORKDIR references to UNPACKDIR

2024-05-02T14:15:51+00:00

Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR references in recipe do_compile/do_install tasks to use UNPACKDIR in the appropraite places instead. (From OE-Core rev: d73595df69667fe9d12ecd407b77a0b8dae2109c) Signed-off-by: Richard Purdie

wpa-supplicant: Fix CVE-2023-52160

2024-02-29T10:26:13+00:00

PEAP client: Update Phase 2 authentication requirements. Also see https://www.top10vpn.com/research/wifi-vulnerabilities/ (From OE-Core rev: 57b6a329df897de69ae8b90706d9fe37e0ed6d35) Signed-off-by: Claus Stovgaard Signed-off-by: Richard Purdie

recipes, classes: Avoid adding extra whitespace to PACKAGESPLITFUNCS

2023-01-12T23:08:58+00:00

This is a follow-up to commit 846ff49465 to remove the extra whitespace that is no longer needed after converting :append and :prepend to += and =+. (From OE-Core rev: 5a38be49e451c9f9d973b10a33c3972507f7b18a) Signed-off-by: Peter Kjellerstedt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

recipes/classes: Drop prepend/append usage with PACKAGESPLITFUNCS

2023-01-05T11:52:50+00:00

As far as I can tell, none of these uses of PACKAGESPLITFUNCS need append/prepend operators, the standard += and =+ can work just fine. Since OE-Core is copied a lot, use the preferred syntax which is also simpler to parse and change. (From OE-Core rev: 846ff49465337dddd75a83161f41f48117f6571c) Signed-off-by: Richard Purdie