NetworkManager: user configuration not honoured leaving the connection unauthenticated via insecure defaults
Published Jun 8, 2020
4.3
MEDIUMCVSS 3.1
EPSS 0.99%
Description
It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely.
Affected products
- Vendor n/a Product NetworkManager Defaultn/a
- Version 1.24.2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | NetworkManager | n/a |
|
Configuration 1
- < 1.22.14
- ≥ 1.24.0 · < 1.24.2
Configuration 2
- 31
No data.
Red Hat Enterprise Linux 7
NetworkManager-1:1.18.8-1.el7
Fixed · RHSA-2020:4003
Red Hat Enterprise Linux 8
NetworkManager-1:1.22.8-5.el8_2
Fixed · RHSA-2020:3011
Red Hat Enterprise Linux 8
NetworkManager-1:1.22.8-5.el8_2
Fixed · RHSA-2020:3011
Red Hat Enterprise Linux 5
NetworkManager
Out of support scope
Red Hat Enterprise Linux 6
NetworkManager
Out of support scope
Red Hat Enterprise Linux 9
NetworkManager
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | NetworkManager-1:1.18.8-1.el7 | Fixed | RHSA-2020:4003 |
| Red Hat Enterprise Linux 8 | NetworkManager-1:1.22.8-5.el8_2 | Fixed | RHSA-2020:3011 |
| Red Hat Enterprise Linux 8 | NetworkManager-1:1.22.8-5.el8_2 | Fixed | RHSA-2020:3011 |
| Red Hat Enterprise Linux 5 | NetworkManager | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | NetworkManager | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | NetworkManager | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (7)
- https://access.redhat.com/security/cve/CVE-2020-10754 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1841041 Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10754 x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3172 Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44FTVXWKDYIAMOOP2PZMUY3D2QNWAVBZ/ vendor-advisoryx_refsource_FEDORA
- https://nvd.nist.gov/vuln/detail/CVE-2020-10754
- https://www.cve.org/CVERecord?id=CVE-2020-10754
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-10754 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1841041 | Issue Tracking | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10754 | x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3172 | Advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44FTVXWKDYIAMOOP2PZMUY3D2QNWAVBZ/ | vendor-advisoryx_refsource_FEDORA | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-10754 | ||
| https://www.cve.org/CVERecord?id=CVE-2020-10754 |
Change history (0)
No recorded changes yet.