Moderate: NetworkManager security, bug fix, and enhancement update
Summary
RLSA-2021:4361: Moderate: NetworkManager security, bug fix, and enhancement update. Affects NetworkManager versions < 1:1.32.10-4.el8. Fixed in 1:1.32.10-4.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. It can handle Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as integrate with various VPN services. The package under scrutiny is NetworkManager version 1.32.10 on Rocky Linux 8.5.
Vulnerability Detail
The vulnerability identified as CVE-2020-13529 affects NetworkManager. It is related to the DHCP FORCERENEW authentication not being implemented, which can lead to a system running the DHCP client having its network reconfigured. The vulnerability has a CVSS score of 6.1 and is categorized as having an Attack Vector (AV) of Adjacent Network (A), Attack Complexity (AC) of High (H), Privileges Required (PR) of None (N), User Interaction (UI) of None (N), Scope (S) of Changed (C), Confidentiality Impact (C) of None (N), Integrity Impact (I) of None (N), and Availability Impact (A) of High (H).
How To Fix
Minimum fixed version
1:1.32.10-4.el8
This is the first release that contains the fix.
sudo dnf update NetworkManagerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the NetworkManager package on Rocky Linux 8.5 is affected by a moderate security vulnerability (CVE-2020-13529). It is recommended to upgrade to version 1.32.10-4.el8 or later to mitigate the issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for NetworkManager →
FAQ
NetworkManager is a system network service that manages network devices and connections, providing active network connectivity when available.
The vulnerability affects NetworkManager version 1.32.10 on Rocky Linux 8.5.
The vulnerability can cause a system running the DHCP client to have its network reconfigured.
The CVSS score of this vulnerability is 6.1.
To fix this vulnerability, upgrade NetworkManager to version 1.32.10-4.el8 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for NetworkManager.
