openwrt/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch
Petr Štetiar df6a33a8d4 hostapd: update to latest Git hostap_2_9-1331-g5a8b366233f5
Bump to latest Git and refresh all patches in order to get fix for "UPnP
SUBSCRIBE misbehavior in hostapd WPS AP" (CVE-2020-12695).

 General security vulnerability in the way the callback URLs in the UPnP
 SUBSCRIBE command are used were reported (VU#339275, CVE-2020-12695).
 Some of the described issues may be applicable to the use of UPnP in WPS
 AP mode functionality for supporting external registrars.

Ref: https://w1.fi/security/2020-1/
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2020-06-09 16:59:33 +02:00

20 lines
561 B
Diff

--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -2411,11 +2411,13 @@ void ibss_mesh_setup_freq(struct wpa_sup
for (j = 0; j < wpa_s->last_scan_res_used; j++) {
struct wpa_bss *bss = wpa_s->last_scan_res[j];
- if (ssid->mode != WPAS_MODE_IBSS)
+ /* Don't adjust control freq in case of fixed_freq */
+ if (ssid->fixed_freq) {
+ obss_scan = 0;
break;
+ }
- /* Don't adjust control freq in case of fixed_freq */
- if (ssid->fixed_freq)
+ if (ssid->mode != WPAS_MODE_IBSS)
break;
if (!bss_is_ibss(bss))