Debian Patches

Status for wpa/2:2.11-4

Patch Description Author Forwarded Bugs Origin Last update
02_dbus_group_policy.patch Add D-Bus group policy
Debian does not use pam_console but uses group membership
to control access to D-Bus. Activating both options in the conf file
makes it work on Debian and Ubuntu.		 Michael Biebl <biebl@debian.org> no debian 2007-03-08
07_dbus_service_syslog.patch Tweak D-Bus/systemd service activation configuration files:
* log wpa_supplicant messages to syslog
* activate control socket interface so that wpa_cli can be used by D-Bus
activated wpa_supplicant daemon		 Kel Modderman <kel@otaku42.de> no 2012-04-21
allow-tlsv1.patch Enable TLSv1.0 by default
OpenSSL 1.1.1 disables TLSv1.0 by default and sets the security level to 2.
Some older networks may support for TLSv1.0 and less secure cyphers.		 Andrej Shadura <andrewsh@debian.org> no 2018-12-15
disable-eapol-werror.patch Disable -Werror for eapol_test
This may make sense for the upstream, but we just want to build
the tool to be useful to our users; dealing with build errors due
to issues normally manifesting themselves as warnings is burdening
for Debian and its downstreams.		 Andrej Shadura <andrew.shadura@collabora.co.uk> no 2021-02-12
wpa_service_ignore-on-isolate.patch Add IgnoreOnIsolate=yes to keep wpa-supplicant running while systemctl isolate

> Add IgnoreOnIsolate=yes so that when switching "runlevels" in
> oem-config will not kill off wpa and cause wireless to be
> unavailable on first boot. (LP: #1576024)

Also happens when running systemctl isolate default.target:

> NM should be detecting that wpasupplicant is not running and start
> it -- this should already have been working by way of wpasupplicant
> being dbus-activated.
[...]
> It seems to me like IgnoreOnIsolate for wpasupplicant would be the
> right thing to do, or to figure out why it isn't being properly
> started when NM tries to use it.		 Mathieu Trudel-Lapierre <cyphermox@ubuntu.com> no 2017-03-13
systemd-add-reload-support.patch Add reload support to the systemd unit files
When wifi password is written in /etc/wpa_supplicant/wpa_supplicant-if.conf,
wpa_supplicant@if.service is started by systemd.
When one adds a new pair of SSID and its password in the above config
file, wpa_supplicant has to reload the changed config file.
But "systemctl reload" was not accepted because "ExecReload" was missing
from wpa_supplicant@.service.		 Ryutaroh Matsumoto <ryutaroh.matsumoto@nagoya-u.jp> no debian 2019-07-08
manpage-replace-wheel-with-netdev.patch Replace the wheel group with netdev
wpa_supplicant.conf(5) manpage includes multiple examples with group wheel.
Group wheel does not exist on Debian as a result the example fails.		 Thomas Glanzmann <thomas@glanzmann.de> no debian 2022-02-13
upstream-fixes/0001-nl80211-add-extra-ies-only-if-allowed-by-driver.patch nl80211: add extra-ies only if allowed by driver
Upgrading wpa_supplicant from 2.9 to 2.10 breaks broadcom-wl
based adapters. The reason for it is hostapd tries to install additional
IEs for scanning while the driver does not support this.

The kernel indicates the maximum number of bytes for additional scan IEs
using the NL80211_ATTR_MAX_SCAN_IE_LEN attribute. Save this value and
only add additional scan IEs in case the driver can accommodate these
additional IEs.		 David Bauer <mail@david-bauer.net> yes debian upstream http://lists.infradead.org/pipermail/hostap/2022-January/040185.html 2022-01-30
allow-legacy-renegotiation.patch Allow legacy renegotiation to fix PEAP issues with some servers James Ralston <ralston@pobox.com> no 2022-05-01
wpa_service_netdev.patch Configure wpa_supplicant.service to create control sockets owned by group netdev Andrej Shadura <andrew.shadura@collabora.co.uk> no debian 2022-06-15
CVE-2024-5290-lib_engine_trusted_path.patch only load libraries from trusted path Marc Deslauriers <marc.deslauriers@canonical.com> no 2026-02-16
Bump-DEFAULT_BSS_MAX_COUNT-to-1000.patch Bump DEFAULT_BSS_MAX_COUNT to 1000
Many congested areas have more than 200 APs in range
of a typical device. When the number of APs exceeds
BSS_MAX_COUNT, even nearby APs can be absent from
the scanning device's AP list.
This patch bumps the default to 1000 to be more in
line with a realistic modern max number of APs
in a given area.		 Mitchell Augustin <mitchell.augustin@canonical.com> no 2026-02-16
0013-Remove-misleading-wpa_cli-usage-comment.patch Remove misleading wpa_cli usage comment
# wpa_cli set
Selected interface 'wlan0'
Invalid SET command - at least 2 arguments are required.		 Andrej Shadura <andrew.shadura@collabora.co.uk> no debian 2026-02-16
0014-sae_pk_gen-needs-random_get_bytes-wpa_key_mgmt_txt-w.patch sae_pk_gen needs random_get_bytes, wpa_key_mgmt_txt, wpa_akm_to_suite Andrej Shadura <andrew.shadura@collabora.co.uk> no 2026-02-16
0015-Revert-Mark-authorization-completed-on-driver-indica.patch Revert "Mark authorization completed on driver indication during 4-way HS offload"

This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.		 Janne Grunau <janne-fdr@jannau.net> yes upstream vendor, https://src.fedoraproject.org/fork/jannau/rpms/wpa_supplicant/c/a5b0db1716b7b4e63a297dcb5b10e98317c54205 2024-08-04
0016-dbus-Add-SaePasswordMismatch-signal-on-AP-indication.patch dbus: Add SaePasswordMismatch signal on AP indication of failed SAE auth

Per the IEEE 802.11 standard, status code 15
(WLAN_STATUS_CHALLENGE_FAIL), when returned in an Authentication frame
of an SAE exchange, is indicative of a password mismatch.

Add a new dbus signal "SaePasswordMismatch" and emit it when a password
mismatch is detected as defined by that scenario.


(cherry picked from commit 446a274b89e32dac8934f64822e5a3acee190dad)		 Mitchell Augustin <mitchell.augustin@canonical.com> not-needed upstream, 446a274b89e32dac8934f64822e5a3acee190dad 2025-10-03
0019-Send-CTRL-EVENT-SIGNAL-CHANGE-message-to-control-int.patch Send CTRL-EVENT-SIGNAL-CHANGE message to control interfaces only
The default logging level for the CTRL-EVENT-SIGNAL-CHANGE message
may be repeated many times and fill the log file or journal.

For example https://bugzilla.redhat.com/show_bug.cgi?id=2309148 and
the first few results from searching CTRL-EVENT-SIGNAL-CHANGE on the
web contain various complaints and workarounds.

Change the logging method to wpa_msg_ctrl to avoid sending frequent
messages to the syslog but still allow the message to be consumed by
control interface monitors.		 Kan-Ru Chen <kanru@kanru.info> no upstream, https://w1.fi/cgit/hostap/commit/?id=c330b5820eefa8e703dbce7278c2a62d9c69166a 2024-12-23
openssl-4.0-asn1-string-accessors.patch OpenSSL: Use ASN1_STRING_length/get0_data() more consistently
Some of the accesses to ASN1_IA5STRING were using direct references to
the structure members. Replace those with helper functions to avoid the
direct access. This is needed for OpenSSL 4.0.		 Jouni Malinen <j@w1.fi> no upstream, https://git.w1.fi/cgit/hostap/commit/?id=141abf49a432c9a0f4f38c47a477ab258ec9e239 2026-04-06
wpa_supplicant-OpenSSL-Use-pkcs11-provider-when-OPENSSL_NO_ENGINE-i.patch OpenSSL: Use pkcs11-provider when OPENSSL_NO_ENGINE is defined

Now that ENGINE API starts being deprecated in distros (like Fedora [1])
wpa_supplicant users might need a way to load certificates and keys from
PKCS11 URIs even when OPENSSL_NO_ENGINE is defined. We can do that using
pkcs11-provider: load it by default in wpa_supplicant, and try to use it
when OPENSSL_NO_ENGINE is defined and configuration requests PKCS11 URIs
for certificates / keys.

Inspired by pkcs11-provider test program 'tlssetkey.c' [2]

[1] https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
[2] https://github.com/latchset/pkcs11-provider/blob/main/tests/tlssetkey.c		 Davide Caratti <davide.caratti@gmail.com> no 2025-01-15
wpa_supplicant-OpenSSL-Support-PEM-encoded-chain-from-ca_cert-blob.patch OpenSSL: Support PEM encoded chain from ca_cert blob
Support configuring a chain of certificates through a ca_cert blob.

Since the code to to add the certificate to the store is used in
multiple places in tls_connection_ca_cert(), extract it to a separate
function.

(cherry picked from commit 9bb25b01fe843924113883a93236d43bb77d4cb1)		 Beniamino Galvani <bgalvani@redhat.com> no 2025-12-19
CVE-2026-78807.patch Require network_ctx and AKMP match for accepting PMKSA entry
When wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID
indicated by the AP/Authenticator, a PMKSA for the same AA was accepted
without enforcing matching network_ctx (i.e., same network configuration
block) and AKMP. This could allow misbehaving APs to make wpa_supplicant
use an unacceptable PMKSA entry that was generated for a different
network for AKMP under certain conditions. This could result in showing
a connection to an incorrect network when an attacker has credentials to
one network in wpa_supplicant configuration, but not to another network.

Fix this by accepting the PMKID to set the PMKSA for an association only
if the PMKSA with the same PMKID is for the same network and was
generated using the same AKMP.		 Jouni Malinen <jouni.malinen@oss.qualcomm.com> no 2026-07-06

All known versions for source package 'wpa'

Links