Threats affecting pkg:rpm/redhat/NetworkManager

A local privilege escalation vulnerability exists in NetworkManager due to improper handling of malformed MUD URLs in the dhclient backend. This flaw affects Red Hat Enterprise Linux 9 versions prior to 9.8. The issue has been rated as moderate severity by Red Hat Product Security. A security update fixing this vulnerability is available in version 9.8.

A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.

A moderate severity vulnerability (CVE-2024-3661) in NetworkManager allows DHCP routing options to manipulate interface-based VPN traffic. NetworkManager is a system service managing network devices and connections, including VPN integration. This issue affects Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. A security update addressing this vulnerability is available from Red Hat.

A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service.