| Name | TEMP-1148985-A50803 |
| Description | wpa_config_write() follows symlinks (no O_NOFOLLOW) -> arbitrary root file overwrite by a netdev-group user |
| Source | Automatically generated temporary name. Not for external reference. |
| Debian Bugs | 1148985 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| wpa (PTS) | bookworm | 2:2.10-12+deb12u3 | vulnerable |
| bookworm (security) | 2:2.10-12+deb12u2 | vulnerable |
| trixie | 2:2.10-24 | vulnerable |
| forky, sid | 2:2.11-7 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| wpa | source | (unstable) | 2:2.11-7 | | | 1148985 |
Notes
https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2163513
https://git.w1.fi/cgit/hostap/commit/?id=e3d1ebda8117c455547b8a9fb06460fb6a405373
https://git.w1.fi/cgit/hostap/commit/?id=1037cc3678ef316ec65059897a941ac3bcfb44bb
https://git.w1.fi/cgit/hostap/commit/?id=c53b2ce62ee11f0d5d95177feeb031196a5ccd25
https://git.w1.fi/cgit/hostap/commit/?id=b35d7d48bb646eda965fc4aa7cee750eacd87687
https://git.w1.fi/cgit/hostap/commit/?id=4540af010df3f4d02240757fb0cbff29339a12c3
https://git.w1.fi/cgit/hostap/commit/?id=e3937427e702f2efd45b2bd3cdc3e8591c3280e4
https://git.w1.fi/cgit/hostap/commit/?id=50e7efc698f9211717f484614e04f42e4f4f7878
https://git.w1.fi/cgit/hostap/commit/?id=e7a37b0876dc611195acfaec04fb53880a506666
Apply additionally change to start activated wpa_supplicatn with -x/etc/wpa_supplicant/:
https://salsa.debian.org/debian/wpa/-/blob/debian/2%252.11-7/debian/patches/bug1148985-09-restrict-dbus-config-prefix.patch