PT-2020-6870 · Unknown+4 · Networkmanager+4

Published 2020-05-17 · Updated 2024-06-15 · CVE-2020-10754

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Network Manager (affected versions not specified)

Description The issue is related to the nmcli command line interface of Network Manager, where incorrect settings are applied when creating a new profile. This allows a remote attacker to access confidential data. Specifically, nmcli does not honor the 802-1x.ca-path and 802-1x.phase2-ca-path settings when creating a new profile, resulting in insecure connections.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

ALT-PU-2020-2862

BDU:2023-02641

CESA-2020_3011

CESA-2020_4003

CVE-2020-10754

MGASA-2020-0260

OPENSUSE-SU-2024:10602-1

RHSA-2020:3011

RHSA-2020:4003

RHSA-2020_3011

RHSA-2020_4003

Affected Products

Alt Linux

Astra Linux

Centos

Networkmanager

Red Hat

References · 27

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10754 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10602-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10754 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10754 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0260.html · Security Note
• https://bdu.fstec.ru/vul/2023-02641 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10754 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44FTVXWKDYIAMOOP2PZMUY3D2QNWAVBZ · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3011.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0260 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/SI4LWYUPI7M6B24ABADK24T77VF65B4A · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4003.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-10754 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10754 · Vendor Advisory