Moderate: NetworkManager security, bug fix, and enhancement update
Summary
ALSA-2021:4361: Moderate: NetworkManager security, bug fix, and enhancement update. Affects NetworkManager-cloud-setup versions < 1:1.32.10-4.el8. Fixed in 1:1.32.10-4.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. It supports various types of network devices such as Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, and also provides VPN integration with different VPN services. The package affected by this vulnerability is NetworkManager-cloud-setup and NetworkManager-libnm-devel in AlmaLinux 8.
Vulnerability Detail
The vulnerability identified as CVE-2020-13529 affects the NetworkManager package. It is related to DHCP FORCERENEW authentication not being implemented, which can lead to a system running the DHCP client having its network reconfigured. This vulnerability can potentially be exploited by an attacker to manipulate network configurations and disrupt network connectivity on the affected system.
How To Fix
Minimum fixed version
1:1.32.10-4.el8
This is the first release that contains the fix.
sudo dnf update NetworkManager-cloud-setupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the NetworkManager package in AlmaLinux 8 is affected by a moderate security vulnerability (CVE-2020-13529) related to DHCP FORCERENEW authentication. To mitigate this vulnerability, it is advised to upgrade the NetworkManager package to version 1.32.10 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for NetworkManager-cloud-setup →
FAQ
NetworkManager is a system network service that manages network devices and connections, providing active network connectivity when available.
The vulnerability can allow an attacker to manipulate network configurations and disrupt network connectivity on the affected system.
The packages affected by this vulnerability are NetworkManager-cloud-setup and NetworkManager-libnm-devel in AlmaLinux 8.
To fix this vulnerability, it is recommended to upgrade the NetworkManager package to version 1.32.10 or later.
You can find more information about this vulnerability in the CVE page(s) listed in the References section of the AlmaLinux Release Notes.
References
Related vulnerabilities
Recent vulnerabilities recorded for NetworkManager-cloud-setup.
