REDHAT-BUG-2313828

First published: Fri Sep 20 2024(Updated: )

A security issue in NM-libreswan, where we fail to sanitize the VPN configuration from a local unprivileged user and pass it directly to Libreswan. The libreswan connection configuration is simple key=value format, but we fail to check for or escape special characters, including newlines, which makes it possible for the user to trick us to treat values as key. Unfortunately, there's one particular key that takes an executable command as an argument: leftupdown (couldn't find more in ipsec.conf(5)). We normally use it to specify the NM-libreswan callback, that would pass L3 configuration back to NM. It can be abused to execute arbitrary code.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/type
• agent/description
• agent/first-publish-date
• agent/event
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2024-9050
• agent/last-modified-date
• agent/references
• agent/source
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/libreswan
• canonical/libreswan
• vendor/nm-libreswan
• canonical/nm-libreswan nm-libreswan