<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="7">
<package pkgid="ac6b1fff9101f95aadbf66f9ca446774a3958e9187a8b738e63be14e2a71b964021497beb7d187c9a5a64ad94ad080e7180157f243b9d460d749ca9cb61be3de" name="hostapd" arch="i586">
  <version epoch="0" ver="2.11" rel="94.3"/>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1626264000">- fixed AppArmor profile</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1634299200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * hostapd.service</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1637928000">- Fix AppArmor profile -- allow access to /etc/ssl/openssl.cnf
  (bsc#1192959)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1642420800">- Removed obsolete patches:
  * CVE-2019-16275.patch
  * CVE-2020-12695.patch
  * CVE-2021-30004.patch
- Update to version 2.10
  * SAE changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  - added option send SAE Confirm immediately (sae_config_immediate=1)
    after SAE Commit
  - added support for the hash-to-element mechanism (sae_pwe=1 or
    sae_pwe=2)
  - fixed PMKSA caching with OKC
  - added support for SAE-PK
  * EAP-pwd changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  * fixed WPS UPnP SUBSCRIBE handling of invalid operations
    [https://w1.fi/security/2020-1/]
  * fixed PMF disconnection protection bypass
    [https://w1.fi/security/2019-7/]
  * added support for using OpenSSL 3.0
  * fixed various issues in experimental support for EAP-TEAP server
  * added configuration (max_auth_rounds, max_auth_rounds_short) to
    increase the maximum number of EAP message exchanges (mainly to
    support cases with very large certificates) for the EAP server
  * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
  * extended HE (IEEE 802.11ax) support, including 6 GHz support
  * removed obsolete IAPP functionality
  * fixed EAP-FAST server with TLS GCM/CCM ciphers
  * dropped support for libnl 1.1
  * added support for nl80211 control port for EAPOL frame TX/RX
  * fixed OWE key derivation with groups 20 and 21; this breaks backwards
    compatibility for these groups while the default group 19 remains
    backwards compatible; owe_ptk_workaround=1 can be used to enabled a
    a workaround for the group 20/21 backwards compatibility
  * added support for Beacon protection
  * added support for Extended Key ID for pairwise keys
  * removed WEP support from the default build (CONFIG_WEP=y can be used
    to enable it, if really needed)
  * added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
  * added support for Transition Disable mechanism to allow the AP to
    automatically disable transition mode to improve security
  * added support for PASN
  * added EAP-TLS server support for TLS 1.3 (disabled by default for now)
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1647000000">- Adjust config
  * Enable SAE
  * Enable DPP
  * Enable wired driver
  * Enable Airtime policy support
  * Enable Fast Initial Link Setup (FILS) (IEEE 802.11ai)</changelog>
  <changelog author="chris@computersalat.de" date="1723118400">- 2024-07-20 - v2.11
  * Wi-Fi Easy Connect
  - add support for DPP release 3
  - allow Configurator parameters to be provided during config
    exchange
  * HE/IEEE 802.11ax/Wi-Fi 6
  - various fixes
  * EHT/IEEE 802.11be/Wi-Fi 7
  - add preliminary support
  * SAE: add support for fetching the password from a RADIUS server
  * support OpenSSL 3.0 API changes
  * support background radar detection and CAC with some additional
    drivers
  * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
  * EAP-SIM/AKA: support IMSI privacy
  * improve 4-way handshake operations
  - use Secure=1 in message 3 during PTK rekeying
  * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
    to avoid interoperability issues
  * support new SAE AKM suites with variable length keys
  * support new AKM for 802.1X/EAP with SHA384
  * extend PASN support for secure ranging
  * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  - this is based on additional details being added in the IEEE 802.11
    standard
  - the new implementation is not backwards compatible
  * improved ACS to cover additional channel types/bandwidths
  * extended Multiple BSSID support
  * fix beacon protection with FT protocol (incorrect BIGTK was provided)
  * support unsynchronized service discovery (USD)
  * add preliminary support for RADIUS/TLS
  * add support for explicit SSID protection in 4-way handshake
    (a mitigation for CVE-2023-52424; disabled by default for now, can be
    enabled with ssid_protection=1)
  * fix SAE H2E rejected groups validation to avoid downgrade attacks
  * use stricter validation for some RADIUS messages
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1741867200">- CVE-2025-24912: hostapd fails to process crafted RADIUS packets
  properly (bsc#1239461)
  [+ CVE-2025-24912.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1781265600">- bsc#1268083 - hostapd segmentation fault during fast restart cycles.
  [+ nl80211_NULL_pointer_check_for_link.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1784116800">- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)</changelog>
  <changelog author="chris@computersalat.de" date="1784808000">- Update hostapd.service
  * restart on failure</changelog>
</package>
<package pkgid="0d53b5ef2c4898bbf6d49e6b11a572d2962c7475f3a7837332aa3922452078d407aee8403af860c3c84457318376eb7b8b9b95909690efe292897fbb3fa7bf7f" name="hostapd" arch="src">
  <version epoch="0" ver="2.11" rel="94.3"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1539950400">- Added rebased-v2.6-0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
  Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).</changelog>
  <changelog author="mardnh@gmx.de" date="1544184000">- Update to version 2.7
  * fixed WPA packet number reuse with replayed messages and key
    reinstallation
    [http://w1.fi/security/2017-1/] (CVE-2017-13082) (bsc#1056061)
  * added support for FILS (IEEE 802.11ai) shared key authentication
  * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
    and transition mode defined by WFA)
  * added support for DPP (Wi-Fi Device Provisioning Protocol)
  * FT:
  - added local generation of PMK-R0/PMK-R1 for FT-PSK
    (ft_psk_generate_local=1)
  - replaced inter-AP protocol with a cleaner design that is more
    easily extensible; this breaks backward compatibility and requires
    all APs in the ESS to be updated at the same time to maintain FT
    functionality
  - added support for wildcard R0KH/R1KH
  - replaced r0_key_lifetime (minutes) parameter with
    ft_r0_key_lifetime (seconds)
  - fixed wpa_psk_file use for FT-PSK
  - fixed FT-SAE PMKID matching
  - added expiration to PMK-R0 and PMK-R1 cache
  - added IEEE VLAN support (including tagged VLANs)
  - added support for SHA384 based AKM
  * SAE
  - fixed some PMKSA caching cases with SAE
  - added support for configuring SAE password separately of the
    WPA2 PSK/passphrase
  - added option to require MFP for SAE associations
    (sae_require_pmf=1)
  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
    for SAE;
    note: this is not backwards compatible, i.e., both the AP and
    station side implementations will need to be update at the same
    time to maintain interoperability
  - added support for Password Identifier
  * hostapd_cli: added support for command history and completion
  * added support for requesting beacon report
  * large number of other fixes, cleanup, and extensions
  * added option to configure EAPOL-Key retry limits
    (wpa_group_update_count and wpa_pairwise_update_count)
  * removed all PeerKey functionality
  * fixed nl80211 AP mode configuration regression with Linux 4.15 and
    newer
  * added support for using wolfSSL cryptographic library
  * fixed some 20/40 MHz coexistence cases where the BSS could drop to
    20 MHz even when 40 MHz would be allowed
  * Hotspot 2.0
  - added support for setting Venue URL ANQP-element (venue_url)
  - added support for advertising Hotspot 2.0 operator icons
  - added support for Roaming Consortium Selection element
  - added support for Terms and Conditions
  - added support for OSEN connection in a shared RSN BSS
  * added support for using OpenSSL 1.1.1
  * added EAP-pwd server support for salted passwords
- Remove not longer needed patches (fixed upstream)
  * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
  * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
  * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
  * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
  * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
  * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
  * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
  * rebased-v2.6-0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
- Verify source signature</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1545048000">- Applied spec-cleaner
- Added bug reference
- Use defconfig file as template for configuration instead of patching it
  during build. This is easier to maintain in the long run. This removes the
  patch hostapd-2.6-defconfig.patch in favor of a simple config file, which is
  copied over from the source directory.
- Enabled CLI editing and history support.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1545998400">- Use noun phrase in summary.</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1556107200">- Update to version 2.8
  * SAE changes
  - added support for SAE Password Identifier
  - changed default configuration to enable only group 19
    (i.e., disable groups 20, 21, 25, 26 from default configuration) and
    disable all unsuitable groups completely based on REVmd changes
  - improved anti-clogging token mechanism and SAE authentication
    frame processing during heavy CPU load; this mitigates some issues
    with potential DoS attacks trying to flood an AP with large number
    of SAE messages
  - added Finite Cyclic Group field in status code 77 responses
  - reject use of unsuitable groups based on new implementation guidance
    in REVmd (allow only FFC groups with prime &gt;= 3072 bits and ECC
    groups with prime &gt;= 256)
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-1/] (CVE-2019-9494)
  - fixed confirm message validation in error cases
    [https://w1.fi/security/2019-3/] (CVE-2019-9496)
  * EAP-pwd changes
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-2/] (CVE-2019-9495)
  - verify peer scalar/element
    [https://w1.fi/security/2019-4/] (CVE-2019-9497 and CVE-2019-9498)
  - fix message reassembly issue with unexpected fragment
    [https://w1.fi/security/2019-5/]
  - enforce rand,mask generation rules more strictly
  - fix a memory leak in PWE derivation
  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and
    27)
  * Hotspot 2.0 changes
  - added support for release number 3
  - reject release 2 or newer association without PMF
  * added support for RSN operating channel validation
    (CONFIG_OCV=y and configuration parameter ocv=1)
  * added Multi-AP protocol support
  * added FTM responder configuration
  * fixed build with LibreSSL
  * added FT/RRB workaround for short Ethernet frame padding
  * fixed KEK2 derivation for FILS+FT
  * added RSSI-based association rejection from OCE
  * extended beacon reporting functionality
  * VLAN changes
  - allow local VLAN management with remote RADIUS authentication
  - add WPA/WPA2 passphrase/PSK -based VLAN assignment
  * OpenSSL: allow systemwide policies to be overridden
  * extended PEAP to derive EMSK to enable use with ERP/FILS
  * extended WPS to allow SAE configuration to be added automatically
    for PSK (wps_cred_add_sae=1)
  * fixed FT and SA Query Action frame with AP-MLME-in-driver cases
  * OWE: allow Diffie-Hellman Parameter element to be included with DPP
    in preparation for DPP protocol extension
  * RADIUS server: started to accept ERP keyName-NAI as user identity
    automatically without matching EAP database entry
  * fixed PTK rekeying with FILS and FT
  wpa_supplicant:
  * SAE changes
  - added support for SAE Password Identifier
  - changed default configuration to enable only groups 19, 20, 21
    (i.e., disable groups 25 and 26) and disable all unsuitable groups
    completely based on REVmd changes
  - do not regenerate PWE unnecessarily when the AP uses the
    anti-clogging token mechanisms
  - fixed some association cases where both SAE and FT-SAE were enabled
    on both the station and the selected AP
  - started to prefer FT-SAE over SAE AKM if both are enabled
  - started to prefer FT-SAE over FT-PSK if both are enabled
  - fixed FT-SAE when SAE PMKSA caching is used
  - reject use of unsuitable groups based on new implementation guidance
    in REVmd (allow only FFC groups with prime &gt;= 3072 bits and ECC
    groups with prime &gt;= 256)
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-1/] (CVE-2019-9494)
  * EAP-pwd changes
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-2/] (CVE-2019-9495)
  - verify server scalar/element
    [https://w1.fi/security/2019-4/] (CVE-2019-9499)
  - fix message reassembly issue with unexpected fragment
    [https://w1.fi/security/2019-5/]
  - enforce rand,mask generation rules more strictly
  - fix a memory leak in PWE derivation
  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and
    27)
  * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  * Hotspot 2.0 changes
  - do not indicate release number that is higher than the one
    AP supports
  - added support for release number 3
  - enable PMF automatically for network profiles created from
    credentials
  * fixed OWE network profile saving
  * fixed DPP network profile saving
  * added support for RSN operating channel validation
    (CONFIG_OCV=y and network profile parameter ocv=1)
  * added Multi-AP backhaul STA support
  * fixed build with LibreSSL
  * number of MKA/MACsec fixes and extensions
  * extended domain_match and domain_suffix_match to allow list of values
  * fixed dNSName matching in domain_match and domain_suffix_match when
    using wolfSSL
  * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
    are enabled
  * extended nl80211 Connect and external authentication to support
    SAE, FT-SAE, FT-EAP-SHA384
  * fixed KEK2 derivation for FILS+FT
  * extended client_cert file to allow loading of a chain of PEM
    encoded certificates
  * extended beacon reporting functionality
  * extended D-Bus interface with number of new properties
  * fixed a regression in FT-over-DS with mac80211-based drivers
  * OpenSSL: allow systemwide policies to be overridden
  * extended driver flags indication for separate 802.1X and PSK
    4-way handshake offload capability
  * added support for random P2P Device/Interface Address use
  * extended PEAP to derive EMSK to enable use with ERP/FILS
  * extended WPS to allow SAE configuration to be added automatically
    for PSK (wps_cred_add_sae=1)
  * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
  * extended domain_match and domain_suffix_match to allow list of values
  * added a RSN workaround for misbehaving PMF APs that advertise
    IGTK/BIP KeyID using incorrect byte order
  * fixed PTK rekeying with FILS and FT</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1567684800">- Update to version 2.9
  * SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * EAP-pwd changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * fixed FT-EAP initial mobility domain association using PMKSA caching
  * added configuration of airtime policy
  * fixed FILS to and RSNE into (Re)Association Response frames
  * fixed DPP bootstrapping URI parser of channel list
  * added support for regulatory WMM limitation (for ETSI)
  * added support for MACsec Key Agreement using IEEE 802.1X/PSK
  * added experimental support for EAP-TEAP server (RFC 7170)
  * added experimental support for EAP-TLS server with TLS v1.3
  * added support for two server certificates/keys (RSA/ECC)
  * added AKMSuiteSelector into "STA &lt;addr&gt;" control interface data to
    determine with AKM was used for an association
  * added eap_sim_id parameter to allow EAP-SIM/AKA server pseudonym and
    fast reauthentication use to be disabled
  * fixed an ECDH operation corner case with OpenSSL</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1587643200">- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass
  (bsc#1150934)</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1601380800">- Add CVE-2020-12695.patch -- UPnP SUBSCRIBE misbehavior in hostapd WPS AP
  (bsc#1172700)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1614081600">- added AppArmor profile (source apparmor-usr.sbin.hostapd)</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1617710400">- Add CVE-2021-30004.patch -- forging attacks may occur because
  AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c
  (bsc#1184348)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1626264000">- fixed AppArmor profile</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1634299200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * hostapd.service</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1637928000">- Fix AppArmor profile -- allow access to /etc/ssl/openssl.cnf
  (bsc#1192959)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1642420800">- Removed obsolete patches:
  * CVE-2019-16275.patch
  * CVE-2020-12695.patch
  * CVE-2021-30004.patch
- Update to version 2.10
  * SAE changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  - added option send SAE Confirm immediately (sae_config_immediate=1)
    after SAE Commit
  - added support for the hash-to-element mechanism (sae_pwe=1 or
    sae_pwe=2)
  - fixed PMKSA caching with OKC
  - added support for SAE-PK
  * EAP-pwd changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  * fixed WPS UPnP SUBSCRIBE handling of invalid operations
    [https://w1.fi/security/2020-1/]
  * fixed PMF disconnection protection bypass
    [https://w1.fi/security/2019-7/]
  * added support for using OpenSSL 3.0
  * fixed various issues in experimental support for EAP-TEAP server
  * added configuration (max_auth_rounds, max_auth_rounds_short) to
    increase the maximum number of EAP message exchanges (mainly to
    support cases with very large certificates) for the EAP server
  * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
  * extended HE (IEEE 802.11ax) support, including 6 GHz support
  * removed obsolete IAPP functionality
  * fixed EAP-FAST server with TLS GCM/CCM ciphers
  * dropped support for libnl 1.1
  * added support for nl80211 control port for EAPOL frame TX/RX
  * fixed OWE key derivation with groups 20 and 21; this breaks backwards
    compatibility for these groups while the default group 19 remains
    backwards compatible; owe_ptk_workaround=1 can be used to enabled a
    a workaround for the group 20/21 backwards compatibility
  * added support for Beacon protection
  * added support for Extended Key ID for pairwise keys
  * removed WEP support from the default build (CONFIG_WEP=y can be used
    to enable it, if really needed)
  * added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
  * added support for Transition Disable mechanism to allow the AP to
    automatically disable transition mode to improve security
  * added support for PASN
  * added EAP-TLS server support for TLS 1.3 (disabled by default for now)
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1647000000">- Adjust config
  * Enable SAE
  * Enable DPP
  * Enable wired driver
  * Enable Airtime policy support
  * Enable Fast Initial Link Setup (FILS) (IEEE 802.11ai)</changelog>
  <changelog author="chris@computersalat.de" date="1723118400">- 2024-07-20 - v2.11
  * Wi-Fi Easy Connect
  - add support for DPP release 3
  - allow Configurator parameters to be provided during config
    exchange
  * HE/IEEE 802.11ax/Wi-Fi 6
  - various fixes
  * EHT/IEEE 802.11be/Wi-Fi 7
  - add preliminary support
  * SAE: add support for fetching the password from a RADIUS server
  * support OpenSSL 3.0 API changes
  * support background radar detection and CAC with some additional
    drivers
  * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
  * EAP-SIM/AKA: support IMSI privacy
  * improve 4-way handshake operations
  - use Secure=1 in message 3 during PTK rekeying
  * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
    to avoid interoperability issues
  * support new SAE AKM suites with variable length keys
  * support new AKM for 802.1X/EAP with SHA384
  * extend PASN support for secure ranging
  * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  - this is based on additional details being added in the IEEE 802.11
    standard
  - the new implementation is not backwards compatible
  * improved ACS to cover additional channel types/bandwidths
  * extended Multiple BSSID support
  * fix beacon protection with FT protocol (incorrect BIGTK was provided)
  * support unsynchronized service discovery (USD)
  * add preliminary support for RADIUS/TLS
  * add support for explicit SSID protection in 4-way handshake
    (a mitigation for CVE-2023-52424; disabled by default for now, can be
    enabled with ssid_protection=1)
  * fix SAE H2E rejected groups validation to avoid downgrade attacks
  * use stricter validation for some RADIUS messages
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1741867200">- CVE-2025-24912: hostapd fails to process crafted RADIUS packets
  properly (bsc#1239461)
  [+ CVE-2025-24912.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1781265600">- bsc#1268083 - hostapd segmentation fault during fast restart cycles.
  [+ nl80211_NULL_pointer_check_for_link.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1784116800">- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)</changelog>
  <changelog author="chris@computersalat.de" date="1784808000">- Update hostapd.service
  * restart on failure</changelog>
</package>
<package pkgid="05f3b28819103072551e3f8f93dcc415933abdc71683cb156a22a977c77d73ae4ae3e12e30fc85b02a36a4b552b6dea5e2f715018da7830b5fa1ad266963198a" name="hostapd" arch="x86_64">
  <version epoch="0" ver="2.11" rel="94.3"/>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1626264000">- fixed AppArmor profile</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1634299200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * hostapd.service</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1637928000">- Fix AppArmor profile -- allow access to /etc/ssl/openssl.cnf
  (bsc#1192959)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1642420800">- Removed obsolete patches:
  * CVE-2019-16275.patch
  * CVE-2020-12695.patch
  * CVE-2021-30004.patch
- Update to version 2.10
  * SAE changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  - added option send SAE Confirm immediately (sae_config_immediate=1)
    after SAE Commit
  - added support for the hash-to-element mechanism (sae_pwe=1 or
    sae_pwe=2)
  - fixed PMKSA caching with OKC
  - added support for SAE-PK
  * EAP-pwd changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  * fixed WPS UPnP SUBSCRIBE handling of invalid operations
    [https://w1.fi/security/2020-1/]
  * fixed PMF disconnection protection bypass
    [https://w1.fi/security/2019-7/]
  * added support for using OpenSSL 3.0
  * fixed various issues in experimental support for EAP-TEAP server
  * added configuration (max_auth_rounds, max_auth_rounds_short) to
    increase the maximum number of EAP message exchanges (mainly to
    support cases with very large certificates) for the EAP server
  * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
  * extended HE (IEEE 802.11ax) support, including 6 GHz support
  * removed obsolete IAPP functionality
  * fixed EAP-FAST server with TLS GCM/CCM ciphers
  * dropped support for libnl 1.1
  * added support for nl80211 control port for EAPOL frame TX/RX
  * fixed OWE key derivation with groups 20 and 21; this breaks backwards
    compatibility for these groups while the default group 19 remains
    backwards compatible; owe_ptk_workaround=1 can be used to enabled a
    a workaround for the group 20/21 backwards compatibility
  * added support for Beacon protection
  * added support for Extended Key ID for pairwise keys
  * removed WEP support from the default build (CONFIG_WEP=y can be used
    to enable it, if really needed)
  * added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
  * added support for Transition Disable mechanism to allow the AP to
    automatically disable transition mode to improve security
  * added support for PASN
  * added EAP-TLS server support for TLS 1.3 (disabled by default for now)
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1647000000">- Adjust config
  * Enable SAE
  * Enable DPP
  * Enable wired driver
  * Enable Airtime policy support
  * Enable Fast Initial Link Setup (FILS) (IEEE 802.11ai)</changelog>
  <changelog author="chris@computersalat.de" date="1723118400">- 2024-07-20 - v2.11
  * Wi-Fi Easy Connect
  - add support for DPP release 3
  - allow Configurator parameters to be provided during config
    exchange
  * HE/IEEE 802.11ax/Wi-Fi 6
  - various fixes
  * EHT/IEEE 802.11be/Wi-Fi 7
  - add preliminary support
  * SAE: add support for fetching the password from a RADIUS server
  * support OpenSSL 3.0 API changes
  * support background radar detection and CAC with some additional
    drivers
  * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
  * EAP-SIM/AKA: support IMSI privacy
  * improve 4-way handshake operations
  - use Secure=1 in message 3 during PTK rekeying
  * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
    to avoid interoperability issues
  * support new SAE AKM suites with variable length keys
  * support new AKM for 802.1X/EAP with SHA384
  * extend PASN support for secure ranging
  * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  - this is based on additional details being added in the IEEE 802.11
    standard
  - the new implementation is not backwards compatible
  * improved ACS to cover additional channel types/bandwidths
  * extended Multiple BSSID support
  * fix beacon protection with FT protocol (incorrect BIGTK was provided)
  * support unsynchronized service discovery (USD)
  * add preliminary support for RADIUS/TLS
  * add support for explicit SSID protection in 4-way handshake
    (a mitigation for CVE-2023-52424; disabled by default for now, can be
    enabled with ssid_protection=1)
  * fix SAE H2E rejected groups validation to avoid downgrade attacks
  * use stricter validation for some RADIUS messages
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1741867200">- CVE-2025-24912: hostapd fails to process crafted RADIUS packets
  properly (bsc#1239461)
  [+ CVE-2025-24912.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1781265600">- bsc#1268083 - hostapd segmentation fault during fast restart cycles.
  [+ nl80211_NULL_pointer_check_for_link.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1784116800">- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)</changelog>
  <changelog author="chris@computersalat.de" date="1784808000">- Update hostapd.service
  * restart on failure</changelog>
</package>
<package pkgid="c1595217b823127266b46299683de5bdd885afc3584752ab60cadc9d98bdd3dad991467fba9a23bacc4269202900c82bd87ae8a06dc2c16c1078b8d7f03fa84d" name="hostapd-debuginfo" arch="i586">
  <version epoch="0" ver="2.11" rel="94.3"/>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1626264000">- fixed AppArmor profile</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1634299200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * hostapd.service</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1637928000">- Fix AppArmor profile -- allow access to /etc/ssl/openssl.cnf
  (bsc#1192959)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1642420800">- Removed obsolete patches:
  * CVE-2019-16275.patch
  * CVE-2020-12695.patch
  * CVE-2021-30004.patch
- Update to version 2.10
  * SAE changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  - added option send SAE Confirm immediately (sae_config_immediate=1)
    after SAE Commit
  - added support for the hash-to-element mechanism (sae_pwe=1 or
    sae_pwe=2)
  - fixed PMKSA caching with OKC
  - added support for SAE-PK
  * EAP-pwd changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  * fixed WPS UPnP SUBSCRIBE handling of invalid operations
    [https://w1.fi/security/2020-1/]
  * fixed PMF disconnection protection bypass
    [https://w1.fi/security/2019-7/]
  * added support for using OpenSSL 3.0
  * fixed various issues in experimental support for EAP-TEAP server
  * added configuration (max_auth_rounds, max_auth_rounds_short) to
    increase the maximum number of EAP message exchanges (mainly to
    support cases with very large certificates) for the EAP server
  * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
  * extended HE (IEEE 802.11ax) support, including 6 GHz support
  * removed obsolete IAPP functionality
  * fixed EAP-FAST server with TLS GCM/CCM ciphers
  * dropped support for libnl 1.1
  * added support for nl80211 control port for EAPOL frame TX/RX
  * fixed OWE key derivation with groups 20 and 21; this breaks backwards
    compatibility for these groups while the default group 19 remains
    backwards compatible; owe_ptk_workaround=1 can be used to enabled a
    a workaround for the group 20/21 backwards compatibility
  * added support for Beacon protection
  * added support for Extended Key ID for pairwise keys
  * removed WEP support from the default build (CONFIG_WEP=y can be used
    to enable it, if really needed)
  * added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
  * added support for Transition Disable mechanism to allow the AP to
    automatically disable transition mode to improve security
  * added support for PASN
  * added EAP-TLS server support for TLS 1.3 (disabled by default for now)
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1647000000">- Adjust config
  * Enable SAE
  * Enable DPP
  * Enable wired driver
  * Enable Airtime policy support
  * Enable Fast Initial Link Setup (FILS) (IEEE 802.11ai)</changelog>
  <changelog author="chris@computersalat.de" date="1723118400">- 2024-07-20 - v2.11
  * Wi-Fi Easy Connect
  - add support for DPP release 3
  - allow Configurator parameters to be provided during config
    exchange
  * HE/IEEE 802.11ax/Wi-Fi 6
  - various fixes
  * EHT/IEEE 802.11be/Wi-Fi 7
  - add preliminary support
  * SAE: add support for fetching the password from a RADIUS server
  * support OpenSSL 3.0 API changes
  * support background radar detection and CAC with some additional
    drivers
  * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
  * EAP-SIM/AKA: support IMSI privacy
  * improve 4-way handshake operations
  - use Secure=1 in message 3 during PTK rekeying
  * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
    to avoid interoperability issues
  * support new SAE AKM suites with variable length keys
  * support new AKM for 802.1X/EAP with SHA384
  * extend PASN support for secure ranging
  * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  - this is based on additional details being added in the IEEE 802.11
    standard
  - the new implementation is not backwards compatible
  * improved ACS to cover additional channel types/bandwidths
  * extended Multiple BSSID support
  * fix beacon protection with FT protocol (incorrect BIGTK was provided)
  * support unsynchronized service discovery (USD)
  * add preliminary support for RADIUS/TLS
  * add support for explicit SSID protection in 4-way handshake
    (a mitigation for CVE-2023-52424; disabled by default for now, can be
    enabled with ssid_protection=1)
  * fix SAE H2E rejected groups validation to avoid downgrade attacks
  * use stricter validation for some RADIUS messages
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1741867200">- CVE-2025-24912: hostapd fails to process crafted RADIUS packets
  properly (bsc#1239461)
  [+ CVE-2025-24912.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1781265600">- bsc#1268083 - hostapd segmentation fault during fast restart cycles.
  [+ nl80211_NULL_pointer_check_for_link.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1784116800">- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)</changelog>
  <changelog author="chris@computersalat.de" date="1784808000">- Update hostapd.service
  * restart on failure</changelog>
</package>
<package pkgid="412f4857ddcdffc16cfe089e390d5ea3a64a00903d51b8313b921fdc3a87e76d404f3f6c66e7354525cdee76354719a56435f6b21add594972265e21012705d0" name="hostapd-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.11" rel="94.3"/>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1626264000">- fixed AppArmor profile</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1634299200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * hostapd.service</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1637928000">- Fix AppArmor profile -- allow access to /etc/ssl/openssl.cnf
  (bsc#1192959)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1642420800">- Removed obsolete patches:
  * CVE-2019-16275.patch
  * CVE-2020-12695.patch
  * CVE-2021-30004.patch
- Update to version 2.10
  * SAE changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  - added option send SAE Confirm immediately (sae_config_immediate=1)
    after SAE Commit
  - added support for the hash-to-element mechanism (sae_pwe=1 or
    sae_pwe=2)
  - fixed PMKSA caching with OKC
  - added support for SAE-PK
  * EAP-pwd changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  * fixed WPS UPnP SUBSCRIBE handling of invalid operations
    [https://w1.fi/security/2020-1/]
  * fixed PMF disconnection protection bypass
    [https://w1.fi/security/2019-7/]
  * added support for using OpenSSL 3.0
  * fixed various issues in experimental support for EAP-TEAP server
  * added configuration (max_auth_rounds, max_auth_rounds_short) to
    increase the maximum number of EAP message exchanges (mainly to
    support cases with very large certificates) for the EAP server
  * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
  * extended HE (IEEE 802.11ax) support, including 6 GHz support
  * removed obsolete IAPP functionality
  * fixed EAP-FAST server with TLS GCM/CCM ciphers
  * dropped support for libnl 1.1
  * added support for nl80211 control port for EAPOL frame TX/RX
  * fixed OWE key derivation with groups 20 and 21; this breaks backwards
    compatibility for these groups while the default group 19 remains
    backwards compatible; owe_ptk_workaround=1 can be used to enabled a
    a workaround for the group 20/21 backwards compatibility
  * added support for Beacon protection
  * added support for Extended Key ID for pairwise keys
  * removed WEP support from the default build (CONFIG_WEP=y can be used
    to enable it, if really needed)
  * added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
  * added support for Transition Disable mechanism to allow the AP to
    automatically disable transition mode to improve security
  * added support for PASN
  * added EAP-TLS server support for TLS 1.3 (disabled by default for now)
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1647000000">- Adjust config
  * Enable SAE
  * Enable DPP
  * Enable wired driver
  * Enable Airtime policy support
  * Enable Fast Initial Link Setup (FILS) (IEEE 802.11ai)</changelog>
  <changelog author="chris@computersalat.de" date="1723118400">- 2024-07-20 - v2.11
  * Wi-Fi Easy Connect
  - add support for DPP release 3
  - allow Configurator parameters to be provided during config
    exchange
  * HE/IEEE 802.11ax/Wi-Fi 6
  - various fixes
  * EHT/IEEE 802.11be/Wi-Fi 7
  - add preliminary support
  * SAE: add support for fetching the password from a RADIUS server
  * support OpenSSL 3.0 API changes
  * support background radar detection and CAC with some additional
    drivers
  * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
  * EAP-SIM/AKA: support IMSI privacy
  * improve 4-way handshake operations
  - use Secure=1 in message 3 during PTK rekeying
  * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
    to avoid interoperability issues
  * support new SAE AKM suites with variable length keys
  * support new AKM for 802.1X/EAP with SHA384
  * extend PASN support for secure ranging
  * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  - this is based on additional details being added in the IEEE 802.11
    standard
  - the new implementation is not backwards compatible
  * improved ACS to cover additional channel types/bandwidths
  * extended Multiple BSSID support
  * fix beacon protection with FT protocol (incorrect BIGTK was provided)
  * support unsynchronized service discovery (USD)
  * add preliminary support for RADIUS/TLS
  * add support for explicit SSID protection in 4-way handshake
    (a mitigation for CVE-2023-52424; disabled by default for now, can be
    enabled with ssid_protection=1)
  * fix SAE H2E rejected groups validation to avoid downgrade attacks
  * use stricter validation for some RADIUS messages
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1741867200">- CVE-2025-24912: hostapd fails to process crafted RADIUS packets
  properly (bsc#1239461)
  [+ CVE-2025-24912.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1781265600">- bsc#1268083 - hostapd segmentation fault during fast restart cycles.
  [+ nl80211_NULL_pointer_check_for_link.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1784116800">- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)</changelog>
  <changelog author="chris@computersalat.de" date="1784808000">- Update hostapd.service
  * restart on failure</changelog>
</package>
<package pkgid="15f0b0b1d38e909fc80e3084f3263b5e5f6b78d6cc9a566dc3f40257141912b5f475810a9d8484bb336f6bc459fa0e90cb26d932b830d5fbbe96959b18fda8e2" name="hostapd-debugsource" arch="i586">
  <version epoch="0" ver="2.11" rel="94.3"/>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1626264000">- fixed AppArmor profile</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1634299200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * hostapd.service</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1637928000">- Fix AppArmor profile -- allow access to /etc/ssl/openssl.cnf
  (bsc#1192959)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1642420800">- Removed obsolete patches:
  * CVE-2019-16275.patch
  * CVE-2020-12695.patch
  * CVE-2021-30004.patch
- Update to version 2.10
  * SAE changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  - added option send SAE Confirm immediately (sae_config_immediate=1)
    after SAE Commit
  - added support for the hash-to-element mechanism (sae_pwe=1 or
    sae_pwe=2)
  - fixed PMKSA caching with OKC
  - added support for SAE-PK
  * EAP-pwd changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  * fixed WPS UPnP SUBSCRIBE handling of invalid operations
    [https://w1.fi/security/2020-1/]
  * fixed PMF disconnection protection bypass
    [https://w1.fi/security/2019-7/]
  * added support for using OpenSSL 3.0
  * fixed various issues in experimental support for EAP-TEAP server
  * added configuration (max_auth_rounds, max_auth_rounds_short) to
    increase the maximum number of EAP message exchanges (mainly to
    support cases with very large certificates) for the EAP server
  * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
  * extended HE (IEEE 802.11ax) support, including 6 GHz support
  * removed obsolete IAPP functionality
  * fixed EAP-FAST server with TLS GCM/CCM ciphers
  * dropped support for libnl 1.1
  * added support for nl80211 control port for EAPOL frame TX/RX
  * fixed OWE key derivation with groups 20 and 21; this breaks backwards
    compatibility for these groups while the default group 19 remains
    backwards compatible; owe_ptk_workaround=1 can be used to enabled a
    a workaround for the group 20/21 backwards compatibility
  * added support for Beacon protection
  * added support for Extended Key ID for pairwise keys
  * removed WEP support from the default build (CONFIG_WEP=y can be used
    to enable it, if really needed)
  * added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
  * added support for Transition Disable mechanism to allow the AP to
    automatically disable transition mode to improve security
  * added support for PASN
  * added EAP-TLS server support for TLS 1.3 (disabled by default for now)
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1647000000">- Adjust config
  * Enable SAE
  * Enable DPP
  * Enable wired driver
  * Enable Airtime policy support
  * Enable Fast Initial Link Setup (FILS) (IEEE 802.11ai)</changelog>
  <changelog author="chris@computersalat.de" date="1723118400">- 2024-07-20 - v2.11
  * Wi-Fi Easy Connect
  - add support for DPP release 3
  - allow Configurator parameters to be provided during config
    exchange
  * HE/IEEE 802.11ax/Wi-Fi 6
  - various fixes
  * EHT/IEEE 802.11be/Wi-Fi 7
  - add preliminary support
  * SAE: add support for fetching the password from a RADIUS server
  * support OpenSSL 3.0 API changes
  * support background radar detection and CAC with some additional
    drivers
  * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
  * EAP-SIM/AKA: support IMSI privacy
  * improve 4-way handshake operations
  - use Secure=1 in message 3 during PTK rekeying
  * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
    to avoid interoperability issues
  * support new SAE AKM suites with variable length keys
  * support new AKM for 802.1X/EAP with SHA384
  * extend PASN support for secure ranging
  * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  - this is based on additional details being added in the IEEE 802.11
    standard
  - the new implementation is not backwards compatible
  * improved ACS to cover additional channel types/bandwidths
  * extended Multiple BSSID support
  * fix beacon protection with FT protocol (incorrect BIGTK was provided)
  * support unsynchronized service discovery (USD)
  * add preliminary support for RADIUS/TLS
  * add support for explicit SSID protection in 4-way handshake
    (a mitigation for CVE-2023-52424; disabled by default for now, can be
    enabled with ssid_protection=1)
  * fix SAE H2E rejected groups validation to avoid downgrade attacks
  * use stricter validation for some RADIUS messages
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1741867200">- CVE-2025-24912: hostapd fails to process crafted RADIUS packets
  properly (bsc#1239461)
  [+ CVE-2025-24912.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1781265600">- bsc#1268083 - hostapd segmentation fault during fast restart cycles.
  [+ nl80211_NULL_pointer_check_for_link.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1784116800">- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)</changelog>
  <changelog author="chris@computersalat.de" date="1784808000">- Update hostapd.service
  * restart on failure</changelog>
</package>
<package pkgid="5003ca1fb36111908f84b68f0f19759f364fb2e03b4eeb1967e752e5b888fc4ebe6ec7797d3f5b498fa3952e2359a4c3b781cbe66141b9b8223912128187747a" name="hostapd-debugsource" arch="x86_64">
  <version epoch="0" ver="2.11" rel="94.3"/>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1626264000">- fixed AppArmor profile</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1634299200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * hostapd.service</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1637928000">- Fix AppArmor profile -- allow access to /etc/ssl/openssl.cnf
  (bsc#1192959)</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1642420800">- Removed obsolete patches:
  * CVE-2019-16275.patch
  * CVE-2020-12695.patch
  * CVE-2021-30004.patch
- Update to version 2.10
  * SAE changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  - added option send SAE Confirm immediately (sae_config_immediate=1)
    after SAE Commit
  - added support for the hash-to-element mechanism (sae_pwe=1 or
    sae_pwe=2)
  - fixed PMKSA caching with OKC
  - added support for SAE-PK
  * EAP-pwd changes
  - improved protection against side channel attacks
    [https://w1.fi/security/2022-1/]
  * fixed WPS UPnP SUBSCRIBE handling of invalid operations
    [https://w1.fi/security/2020-1/]
  * fixed PMF disconnection protection bypass
    [https://w1.fi/security/2019-7/]
  * added support for using OpenSSL 3.0
  * fixed various issues in experimental support for EAP-TEAP server
  * added configuration (max_auth_rounds, max_auth_rounds_short) to
    increase the maximum number of EAP message exchanges (mainly to
    support cases with very large certificates) for the EAP server
  * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol)
  * extended HE (IEEE 802.11ax) support, including 6 GHz support
  * removed obsolete IAPP functionality
  * fixed EAP-FAST server with TLS GCM/CCM ciphers
  * dropped support for libnl 1.1
  * added support for nl80211 control port for EAPOL frame TX/RX
  * fixed OWE key derivation with groups 20 and 21; this breaks backwards
    compatibility for these groups while the default group 19 remains
    backwards compatible; owe_ptk_workaround=1 can be used to enabled a
    a workaround for the group 20/21 backwards compatibility
  * added support for Beacon protection
  * added support for Extended Key ID for pairwise keys
  * removed WEP support from the default build (CONFIG_WEP=y can be used
    to enable it, if really needed)
  * added a build option to remove TKIP support (CONFIG_NO_TKIP=y)
  * added support for Transition Disable mechanism to allow the AP to
    automatically disable transition mode to improve security
  * added support for PASN
  * added EAP-TLS server support for TLS 1.3 (disabled by default for now)
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1647000000">- Adjust config
  * Enable SAE
  * Enable DPP
  * Enable wired driver
  * Enable Airtime policy support
  * Enable Fast Initial Link Setup (FILS) (IEEE 802.11ai)</changelog>
  <changelog author="chris@computersalat.de" date="1723118400">- 2024-07-20 - v2.11
  * Wi-Fi Easy Connect
  - add support for DPP release 3
  - allow Configurator parameters to be provided during config
    exchange
  * HE/IEEE 802.11ax/Wi-Fi 6
  - various fixes
  * EHT/IEEE 802.11be/Wi-Fi 7
  - add preliminary support
  * SAE: add support for fetching the password from a RADIUS server
  * support OpenSSL 3.0 API changes
  * support background radar detection and CAC with some additional
    drivers
  * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3)
  * EAP-SIM/AKA: support IMSI privacy
  * improve 4-way handshake operations
  - use Secure=1 in message 3 during PTK rekeying
  * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases
    to avoid interoperability issues
  * support new SAE AKM suites with variable length keys
  * support new AKM for 802.1X/EAP with SHA384
  * extend PASN support for secure ranging
  * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
  - this is based on additional details being added in the IEEE 802.11
    standard
  - the new implementation is not backwards compatible
  * improved ACS to cover additional channel types/bandwidths
  * extended Multiple BSSID support
  * fix beacon protection with FT protocol (incorrect BIGTK was provided)
  * support unsynchronized service discovery (USD)
  * add preliminary support for RADIUS/TLS
  * add support for explicit SSID protection in 4-way handshake
    (a mitigation for CVE-2023-52424; disabled by default for now, can be
    enabled with ssid_protection=1)
  * fix SAE H2E rejected groups validation to avoid downgrade attacks
  * use stricter validation for some RADIUS messages
  * a large number of other fixes, cleanup, and extensions</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1741867200">- CVE-2025-24912: hostapd fails to process crafted RADIUS packets
  properly (bsc#1239461)
  [+ CVE-2025-24912.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1781265600">- bsc#1268083 - hostapd segmentation fault during fast restart cycles.
  [+ nl80211_NULL_pointer_check_for_link.patch]</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1784116800">- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch
  https://w1.fi/security/2026-2/
- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch
  https://w1.fi/security/2026-3/
- Add CVE-2026-58374.patch: Missing multi-link parsing validation in
  wpa_supplicant and hostapd (bsc#1269892)</changelog>
  <changelog author="chris@computersalat.de" date="1784808000">- Update hostapd.service
  * restart on failure</changelog>
</package>
</otherdata>