Vulnerability in nmstate Library
Summary
ALBA-2022:0360: nmstate bug fix and enhancement update. Affects nmstate versions < 1.1.0-5.el8_5. Fixed in 1.1.0-5.el8_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nmstate library is a powerful tool that manages host networking settings in a declarative manner. It provides a command line interface and a library for managing network configurations. The library is widely used in AlmaLinux 8 ecosystem.
Vulnerability Detail
The vulnerability identified in the nmstate library is related to the handling of ovs-bridge ports and VF names. When attaching a veth, the library changes the names of existing ovs-bridge ports. Additionally, the library expects VF (Virtual Function) names to be different from their actual names if the name starts with 'enp'. These issues can lead to misconfiguration and potential network connectivity problems.
How To Fix
Minimum fixed version
1.1.0-5.el8_5
This is the first release that contains the fix.
sudo dnf update nmstateTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have the latest version of the nmstate package installed.
Conclusion
The nmstate library in AlmaLinux 8 has been identified with a vulnerability related to ovs-bridge ports and VF names. It is recommended to update the nmstate package to version 1.1.0-5.el8_5 or later to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nmstate →
FAQ
Nmstate is a library and command line tool for managing host networking settings in a declarative manner.
The vulnerability can result in misconfiguration and potential network connectivity problems.
To fix this vulnerability, update the nmstate package to version 1.1.0-5.el8_5 or later.
There are no specific workarounds mentioned for this vulnerability.
You can find more information about this vulnerability in the AlmaLinux advisory ALBA-2022:0360.
Related vulnerabilities
Recent vulnerabilities recorded for nmstate.
