#1148985 wpa: wpa_config_write() follows symlinks (no O_NOFOLLOW) -> arbitrary root file overwrite by a netdev-group user

Package:
src:wpa
Source:
src:wpa
Submitter:
Salvatore Bonaccorso
Date:
2026-10-04 18:33:02 UTC
Severity:
normal
Tags:
#1148985#14
Date:
2026-09-26 12:54:58 UTC
From:
To:
Dear maintainer,

I've prepared an NMU for wpa (versioned as 2:2.10-25.1) but I have not
yet uploaded it to any delayed queue, will follow up later on this
(and doing the same changes for trixie). Here is already the proposed
debdiff.

Regards,
Salvatore
#1148985#21
Date:
2026-09-26 20:30:51 UTC
From:
To:
Hi,

One reporter of this issue will test the change, so I'm holding back
the NMU proposal and have not yet done any delayed upload for
unstable.  The respective change for trixie-security is ready as well.

Regards,
Salvatore
#1148985#26
Date:
2026-09-27 12:58:33 UTC
From:
To:
Hello,

Thanks for the patches. If you hear more from the reporter, please let me know.
#1148985#31
Date:
2026-10-04 18:31:34 UTC
From:
To:
Hi Andrej,

It is not yet enough. Please hold back yet a DLA update. I will
followup once we know more, so far the patchset is mostly good but
missed one aspect.

Regards,
Salvatore