Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package wpa_supplicant for openSUSE:Factory checked in at 2026-08-27 18:49:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wpa_supplicant (Old) and /work/SRC/openSUSE:Factory/.wpa_supplicant.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wpa_supplicant" Thu Aug 27 18:49:02 2026 rev:104 rq:1373418 version:2.12 Changes: -------- --- /work/SRC/openSUSE:Factory/wpa_supplicant/wpa_supplicant.changes 2026-08-01 18:29:51.424848518 +0200 +++ /work/SRC/openSUSE:Factory/.wpa_supplicant.new.1265/wpa_supplicant.changes 2026-08-27 18:49:06.406837761 +0200 @@ -1,0 +2,56 @@ +Mon Aug 17 12:22:02 UTC 2026 - Clemens Famulla-Conrad <[email protected]> + +- Update to v2.12: + * support RSN overriding (e.g., WPA3-Personal Compatibility Mode) + * EHT/IEEE 802.11be/Wi-Fi 7 + - more complete support + - fix message validation issues that could enable DoS attacks + - fix group key rekeying + * enable SAE group 20 by default if SAE-EXT-KEY is enabled + * reject unexpected SAE password identifier to avoid DoS attack against + a specific STA + * mandate use of SAE H2E when using password identifiers + * assign VLAN when using SAE with PMKSA caching + * support SPP A-MSDU negotiation + * support IEEE 802.11bi functionality + - changing SAE password identifiers + - EPPKE + - IEEE 802.1X/EAP in Authentication frames + - Association frame encryption + - PMKID privacy + * remove the driver interface for now obsolete Host AP driver + * remove the driver interface for now obsolete Atheros WEXT interface + * move supported, basic, and Beacon TX rate configuration to be at BSS + level instead of per-radio for all BSSs + * fix various issues in Multiple-BSSID functionality + * support OpenSSL 3.0 API changes + * EAP-TEAP: protocol changes based on RFC 9930; this is not compatible + with previous versions + * support Automated Frequency Coordination (AFC) on the 6 GHz band + * improve GAS/ANQP processing to support larger ANQP responses + * a large number of other fixes, cleanup, and extensions + * Remove included patches: + - 0001-wpa_gui-Port-to-Qt6.patch + - CVE-2025-24912.patch + - CVE-2026-58374.patch + - Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch + - SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch + - mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch + - wpa_supplicant_support_pem_encoded_chain.patch + * Refresh patches: + - Revert-Mark-authorization-completed-on-driver-indica.patch + - wpa_supplicant-alloc_size.patch + - wpa_supplicant-flush-debug-output.patch + - wpa_supplicant-sigusr1-changes-debuglevel.patch +- Update build config + * CONFIG_HE_OVERRIDES=y (Support HE overrides) + * CONFIG_IPV6=y + * CONFIG_SAE_PK=y (SAE Public Key, WPA3-Personal) + * CONFIG_IEEE80211BE=y (enable native support for Wi-Fi 7) + * CONFIG_PMKSA_PRIVACY=y (PMKSA caching privacy support) + * CONFIG_IEEE8021X_AUTH=y (IEEE P802.11bi/D4.0, 12.16.5 ) + * CONFIG_TLS_ENGINE_TRUSTED_PATH=y +- Add RADIUS-Fix-Message-Authenticator-attribute-validatio.patch + https://w1.fi/security/2026-5 + +------------------------------------------------------------------- Old: ---- 0001-wpa_gui-Port-to-Qt6.patch CVE-2025-24912.patch CVE-2026-58374.patch Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch wpa_supplicant-2.11.tar.gz wpa_supplicant_support_pem_encoded_chain.patch New: ---- RADIUS-Fix-Message-Authenticator-attribute-validatio.patch wpa_supplicant-2.12.tar.gz ----------(Old B)---------- Old: * Remove included patches: - 0001-wpa_gui-Port-to-Qt6.patch - CVE-2025-24912.patch Old: - 0001-wpa_gui-Port-to-Qt6.patch - CVE-2025-24912.patch - CVE-2026-58374.patch Old: - CVE-2025-24912.patch - CVE-2026-58374.patch - Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch Old: - CVE-2026-58374.patch - Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch - SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch Old: - Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch - SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch - mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch Old: - SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch - mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch - wpa_supplicant_support_pem_encoded_chain.patch Old: - mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch - wpa_supplicant_support_pem_encoded_chain.patch * Refresh patches: ----------(Old E)---------- ----------(New B)---------- New: * CONFIG_TLS_ENGINE_TRUSTED_PATH=y - Add RADIUS-Fix-Message-Authenticator-attribute-validatio.patch https://w1.fi/security/2026-5 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wpa_supplicant.spec ++++++ --- /var/tmp/diff_new_pack.PwyqUO/_old 2026-08-27 18:49:07.317869475 +0200 +++ /var/tmp/diff_new_pack.PwyqUO/_new 2026-08-27 18:49:07.318869510 +0200 @@ -17,7 +17,7 @@ Name: wpa_supplicant -Version: 2.11 +Version: 2.12 Release: 0 Summary: WPA supplicant implementation License: BSD-3-Clause AND GPL-2.0-or-later @@ -39,20 +39,8 @@ Patch3: wpa_supplicant-alloc_size.patch Patch5: wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff Patch6: Revert-Mark-authorization-completed-on-driver-indica.patch -# PATCH-FIX-UPSTREAM CVE-2025-24912.patch, bsc#1239461, CVE-2025-24912 -Patch7: CVE-2025-24912.patch -# PATCH-FIX-UPSTREAM https://w1.fi/cgit/hostap/commit/?id=2ed9806275f9ae37545ca30d9bcce1e94fba1d97 -Patch8: 0001-wpa_gui-Port-to-Qt6.patch -# PATCH-FIX-UPSTREAM bsc#1258365, https://git.w1.fi/cgit/hostap/commit/?id=9bb25b01fe843924113883a93236d43bb77d4cb1 -Patch9: wpa_supplicant_support_pem_encoded_chain.patch -# PATCH-FIX-UPSTREAM CVE-2026-58374, bsc#1269892 Missing multi-link parsing validation -Patch10: CVE-2026-58374.patch -# PATCH-FIX-UPSTREAM https://w1.fi/security/2026-2/ -Patch11: Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch -# PATCH-FIX-UPSTREAM https://w1.fi/security/2026-3/ -Patch12: SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch -# PATCH-FIX-UPSTREAM https://w1.fi/security/2026-4/ -Patch13: mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch +# UPSTREAM-FIX fix https://w1.fi/security/2026-5 +Patch7: RADIUS-Fix-Message-Authenticator-attribute-validatio.patch BuildRequires: pkgconfig BuildRequires: readline-devel BuildRequires: systemd-rpm-macros ++++++ RADIUS-Fix-Message-Authenticator-attribute-validatio.patch ++++++ >From aa02cfa569477f67f3915c8b9a83d1a7ca93693d Mon Sep 17 00:00:00 2001 From: Jouni Malinen <[email protected]> Date: Fri, 14 Aug 2026 11:20:34 +0300 Subject: [PATCH] RADIUS: Fix Message-Authenticator attribute validation Reference: https://w1.fi/security/2026-5 The length of the Message-Authenticator attribute was not verified to be sufficiently long to contain the HMAC-MD5 value before checking that value when checking it from received RADIUS messages. This could result in reading and writing 16 bytes beyond the end of the message buffer when processing a specifically constructed malformed message. The written part is a temporary zeroing followed by restoring the original contents and the main potential impact from this would be process termination. Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. Contributing Researcher: Vivek Parikh. Signed-off-by: Jouni Malinen <[email protected]> --- src/radius/radius.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/src/radius/radius.c +++ b/src/radius/radius.c @@ -695,6 +695,11 @@ int radius_msg_verify_das_req(struct rad return 0; } + if (attr->length != sizeof(*attr) + MD5_MAC_LEN) { + wpa_printf(MSG_WARNING, "Invalid Message-Authenticator length"); + return 1; + } + os_memcpy(orig, attr + 1, MD5_MAC_LEN); os_memset(attr + 1, 0, MD5_MAC_LEN); os_memcpy(orig_authenticator, msg->hdr->authenticator, @@ -993,6 +998,11 @@ int radius_msg_verify_msg_auth(struct ra return 1; } + if (attr->length != sizeof(*attr) + MD5_MAC_LEN) { + wpa_printf(MSG_INFO, "Invalid Message-Authenticator length"); + return 1; + } + os_memcpy(orig, attr + 1, MD5_MAC_LEN); os_memset(attr + 1, 0, MD5_MAC_LEN); if (req_auth) { ++++++ Revert-Mark-authorization-completed-on-driver-indica.patch ++++++ --- /var/tmp/diff_new_pack.PwyqUO/_old 2026-08-27 18:49:07.355870798 +0200 +++ /var/tmp/diff_new_pack.PwyqUO/_new 2026-08-27 18:49:07.360870972 +0200 @@ -1,23 +1,21 @@ -From c970f0f54fd33307e90e355f40d436dfa084c35e Mon Sep 17 00:00:00 2001 -From: Clemens Famulla-Conrad <[email protected]> -Date: Fri, 20 Sep 2024 12:35:04 +0200 +From e7a33a757dc58ebcb1e59a4786e40c2aa7dd277c Mon Sep 17 00:00:00 2001 +From: Clemens Famulla-Conrad <[email protected]> +Date: Mon, 17 Aug 2026 14:07:12 +0200 Subject: [PATCH] Revert "Mark authorization completed on driver indication during 4-way HS offload" Reference: bsc#1230797 This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5. --- - wpa_supplicant/events.c | 25 ++++++++----------------- + wpa_supplicant/events.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) -diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c -index 49917f7aa..bbb3a3eda 100644 --- a/wpa_supplicant/events.c +++ b/wpa_supplicant/events.c -@@ -4327,23 +4327,14 @@ static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s, - eapol_sm_notify_eap_success(wpa_s->eapol, true); - } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) && - wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) { +@@ -4925,23 +4925,14 @@ static int wpa_supplicant_event_assoc(st + wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) || + ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_OWE_OFFLOAD_STA) && + wpa_s->key_mgmt == WPA_KEY_MGMT_OWE)) { - if (already_authorized) { - /* - * We are done; the driver will take care of RSN 4-way @@ -46,7 +44,4 @@ } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) && wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) { /* --- -2.43.0 - ++++++ config ++++++ --- /var/tmp/diff_new_pack.PwyqUO/_old 2026-08-27 18:49:07.390872016 +0200 +++ /var/tmp/diff_new_pack.PwyqUO/_new 2026-08-27 18:49:07.394872156 +0200 @@ -206,9 +206,15 @@ # Support VHT overrides (disable VHT, mask MCS rates, etc.) CONFIG_VHT_OVERRIDES=y +# Support HE overrides +CONFIG_HE_OVERRIDES=y + # Development testing #CONFIG_EAPOL_TEST=y +# Support IPv6 +CONFIG_IPV6=y + # Select control interface backend for external programs, e.g, wpa_cli: # unix = UNIX domain sockets (default for Linux/*BSD) # udp = UDP sockets using localhost (127.0.0.1) @@ -251,6 +257,9 @@ # Simultaneous Authentication of Equals (SAE), WPA3-Personal CONFIG_SAE=y +# SAE Public Key, WPA3-Personal +CONFIG_SAE_PK=y + # WPA3-Enterprise (SuiteB-192) CONFIG_SUITEB=y CONFIG_SUITEB192=y @@ -502,13 +511,9 @@ # IEEE 802.11be EHT support (mainly for AP mode) # CONFIG_IEEE80211AX is mandatory for setting CONFIG_IEEE80211BE. -# Note: This is experimental and work in progress. The definitions are still -# subject to change and this should not be expected to interoperate with the -# final IEEE 802.11be version. -#CONFIG_IEEE80211BE=y +CONFIG_IEEE80211BE=y # Wireless Network Management (IEEE Std 802.11v-2011) -# Note: This is experimental and not complete implementation. #CONFIG_WNM=y # Interworking (IEEE 802.11u) @@ -633,15 +638,13 @@ #CONFIG_BGSCAN_LEARN=y # Opportunistic Wireless Encryption (OWE) -# Experimental implementation of draft-harkins-owe-07.txt CONFIG_OWE=y # Device Provisioning Protocol (DPP) (also known as Wi-Fi Easy Connect) CONFIG_DPP=y # DPP version 2 support CONFIG_DPP2=y -# DPP version 3 support (experimental and still changing; do not enable for -# production use) +# DPP version 3 support #CONFIG_DPP3=y # Wired equivalent privacy (WEP) @@ -662,9 +665,6 @@ #CONFIG_NO_TKIP=y # Pre-Association Security Negotiation (PASN) -# Experimental implementation based on IEEE P802.11z/D2.6 and the protocol -# design is still subject to change. As such, this should not yet be enabled in -# production use. #CONFIG_PASN=y # Disable support for Radio Measurement (IEEE 802.11k) and supported operating @@ -682,3 +682,32 @@ # Wi-Fi Aware unsynchronized service discovery (NAN USD) #CONFIG_NAN_USD=y +# Wi-Fi Aware (NAN) support +#CONFIG_NAN=y + +# Proximity Ranging (PR) support +#CONFIG_PR=y + +# Enhanced Privacy Protection (IEEE P802.11bi) +# Note: These features are experimental and still changing; do not enable for +# production use. +# Encrypted association frame support (needed for EPPKE and EAP in +# Authentication frames) +#CONFIG_ENC_ASSOC=y +# +# PMKSA caching privacy support +CONFIG_PMKSA_PRIVACY=y +# +# IEEE 802.1X (EAP) authentication in Authentication frames +# IEEE P802.11bi/D4.0, 12.16.5 (IEEE 802.1X authentication utilizing +# Authentication frames) +CONFIG_IEEE8021X_AUTH=y + +# OpenSSL PKCS#11/OpenSC engine and module trusted-path validation +# Validate PKCS#11 engine, PKCS#11 module, and OpenSC engine shared library +# paths (root-owned, non-writable regular file under /usr/lib with root-owned +# ancestor directories) before dlopen()ing them. Disabled by default to avoid +# affecting deployments that run wpa_supplicant as a non-root user with shared +# libraries in a custom directory owned by that user. +CONFIG_TLS_ENGINE_TRUSTED_PATH=y + ++++++ wpa_supplicant-2.11.tar.gz -> wpa_supplicant-2.12.tar.gz ++++++ ++++ 148295 lines of diff (skipped) ++++++ wpa_supplicant-alloc_size.patch ++++++ --- /var/tmp/diff_new_pack.PwyqUO/_old 2026-08-27 18:49:09.209935340 +0200 +++ /var/tmp/diff_new_pack.PwyqUO/_new 2026-08-27 18:49:09.228936001 +0200 @@ -1,8 +1,10 @@ -Index: wpa_supplicant-2.10/src/utils/os.h -=================================================================== ---- wpa_supplicant-2.10.orig/src/utils/os.h -+++ wpa_supplicant-2.10/src/utils/os.h -@@ -260,7 +260,7 @@ int os_fdatasync(FILE *stream); +--- + src/utils/os.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/src/utils/os.h ++++ b/src/utils/os.h +@@ -280,7 +280,7 @@ int os_fdatasync(FILE *stream); * * Caller is responsible for freeing the returned buffer with os_free(). */ @@ -11,7 +13,7 @@ /** * os_calloc - Allocate and zero memory for an array -@@ -274,6 +274,8 @@ void * os_zalloc(size_t size); +@@ -294,6 +294,8 @@ void * os_zalloc(size_t size); * * Caller is responsible for freeing the returned buffer with os_free(). */ ++++++ wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff ++++++ --- /var/tmp/diff_new_pack.PwyqUO/_old 2026-08-27 18:49:09.265937289 +0200 +++ /var/tmp/diff_new_pack.PwyqUO/_new 2026-08-27 18:49:09.279937776 +0200 @@ -11,7 +11,7 @@ --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c -@@ -2515,6 +2515,19 @@ +@@ -2806,6 +2806,19 @@ static int tls_verify_cb(int preverify_o debug_print_cert(err_cert, buf); X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf)); @@ -33,7 +33,7 @@ return 0; --- a/src/utils/wpa_debug.c +++ b/src/utils/wpa_debug.c -@@ -66,6 +66,11 @@ +@@ -66,6 +66,11 @@ static int wpa_to_android_level(int leve #endif /* CONFIG_DEBUG_FILE */ @@ -47,15 +47,15 @@ #ifndef CONFIG_ANDROID_LOG --- a/src/utils/wpa_debug.h +++ b/src/utils/wpa_debug.h -@@ -25,6 +25,7 @@ +@@ -25,6 +25,7 @@ enum { #ifdef CONFIG_NO_STDOUT_DEBUG +#define wpa_debug_enabled(x) do { } while (0) #define wpa_debug_print_timestamp() do { } while (0) #define wpa_printf(args...) do { } while (0) - #define wpa_hexdump(l,t,b,le) do { } while (0) -@@ -52,6 +53,13 @@ + #define wpa_debug_open_file(p) do { } while (0) +@@ -82,6 +83,13 @@ void wpa_debug_setup_stdout(void); void wpa_debug_stop_log(void); /** ++++++ wpa_supplicant-flush-debug-output.patch ++++++ --- /var/tmp/diff_new_pack.PwyqUO/_old 2026-08-27 18:49:09.323939308 +0200 +++ /var/tmp/diff_new_pack.PwyqUO/_new 2026-08-27 18:49:09.342939970 +0200 @@ -1,7 +1,9 @@ -Index: wpa_supplicant-2.10/src/utils/wpa_debug.c -=================================================================== ---- wpa_supplicant-2.10.orig/src/utils/wpa_debug.c -+++ wpa_supplicant-2.10/src/utils/wpa_debug.c +--- + src/utils/wpa_debug.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/src/utils/wpa_debug.c ++++ b/src/utils/wpa_debug.c @@ -76,9 +76,11 @@ void wpa_debug_print_timestamp(void) os_get_time(&tv); @@ -15,7 +17,7 @@ #endif /* CONFIG_DEBUG_FILE */ if (!out_file && !wpa_debug_syslog) printf("%ld.%06u: ", (long) tv.sec, (unsigned int) tv.usec); -@@ -231,6 +233,7 @@ void wpa_printf(int level, const char *f +@@ -245,6 +247,7 @@ void wpa_printf(int level, const char *f vfprintf(out_file, fmt, ap); fprintf(out_file, "\n"); va_end(ap); @@ -23,7 +25,7 @@ } #endif /* CONFIG_DEBUG_FILE */ if (!wpa_debug_syslog && !out_file) { -@@ -365,6 +368,7 @@ static void _wpa_hexdump(int level, cons +@@ -379,6 +382,7 @@ static void _wpa_hexdump(int level, cons fprintf(out_file, " [REMOVED]"); } fprintf(out_file, "\n"); @@ -31,7 +33,7 @@ } #endif /* CONFIG_DEBUG_FILE */ if (!wpa_debug_syslog && !out_file) { -@@ -436,12 +440,14 @@ static void _wpa_hexdump_ascii(int level +@@ -450,12 +454,14 @@ static void _wpa_hexdump_ascii(int level fprintf(out_file, "%s - hexdump_ascii(len=%lu): [REMOVED]\n", title, (unsigned long) len); @@ -46,7 +48,7 @@ goto file_done; } fprintf(out_file, "%s - hexdump_ascii(len=%lu):\n", -@@ -466,6 +472,7 @@ static void _wpa_hexdump_ascii(int level +@@ -480,6 +486,7 @@ static void _wpa_hexdump_ascii(int level pos += llen; len -= llen; } ++++++ wpa_supplicant-sigusr1-changes-debuglevel.patch ++++++ --- /var/tmp/diff_new_pack.PwyqUO/_old 2026-08-27 18:49:09.379941258 +0200 +++ /var/tmp/diff_new_pack.PwyqUO/_new 2026-08-27 18:49:09.389941606 +0200 @@ -4,7 +4,7 @@ --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -123,6 +123,22 @@ +@@ -125,6 +125,22 @@ const char *const wpa_supplicant_full_li "\n"; #endif /* CONFIG_NO_STDOUT_DEBUG */ @@ -27,7 +27,7 @@ static void wpa_bss_tmp_disallow_timeout(void *eloop_ctx, void *timeout_ctx); static void wpas_verify_ssid_beacon(void *eloop_ctx, void *timeout_ctx); -@@ -8189,6 +8205,8 @@ +@@ -8940,6 +8956,8 @@ int wpa_supplicant_run(struct wpa_global eloop_register_signal_terminate(wpa_supplicant_terminate, global); eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
