Our nightly builds ships wpasupplicant 2.3-1+deb8u4, according to https://www.debian.org/security/2017/dsa-3999 it's fixed in 2.3-1+deb8u5.

This may address another issue I discovered with the livebuild system. During rebuild, it does not automatically install all the latest security updates available like this one. Anyone knows how to add newer revisions of certain packages to live-build?

@UnicronNL maybe this will fix this issue:

diff --git i/scripts/live-build-config w/scripts/live-build-config
index c1c766f..990cb5c 100755
--- i/scripts/live-build-config
+++ w/scripts/live-build-config
@@ -51,7 +51,8 @@ lb config noauto \
         --mirror-binary {{debian_mirror}} \
         --mirror-binary-security {{debian_security_mirror}} \
         --archive-areas "main contrib non-free" \
-        --firmware-chroot true
+        --firmware-chroot true \
+        --updates true \
         "${@}"

Unfortunately the vyos-build repo is not building anymore so I can't test.

https://github.com/vyos/vyos-build/commit/e5259ccb17e93e110d1dcdeb98f4dc1b9d1df192
This seems to have done the trick thanks.

build issue now hangs on depend on quagga.

This did the trick. Just build a fresh ISO:

root@vyos:/home/vyos# dpkg --list | grep wpa
ii  wpasupplicant                     2.3-1+deb8u5                      amd64        client support for WPA and WPA2 (IEEE 802.11i)

@syncer looks like this is resolved now. All debian security updates are now automatically inserted in every new image.

@UnicronNL Just to make sure, the package included in helium now is also patched?

I've done pkg-release in that package to include the latest commits into debian changelog and update the package version (helium4 now).