Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10754: A flaw was found in nmcli, where the command-line interface to the NetworkManager did not accept the 802-1x.ca-path and 802-1x.phase2-ca-path settings when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and an insecure connection occurs. 1841041: CVE-2020-10754 NetworkManager: user configuration not honoured leaving the connection unauthenticated via insecure defaults
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | NetworkManager | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-adsl | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-bluetooth | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-config-server | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-debuginfo | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-dispatcher-routing-rules | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-glib | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-glib-devel | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-libnm | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-libnm-devel | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-ppp | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-team | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-tui | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-wifi | 1:1.18.8-1.amzn2.0.1 |
| Amazon Linux · 2 | NetworkManager-wwan | 1:1.18.8-1.amzn2.0.1 |
Vulnerabilities 1
-
Medium 4.3
It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-10754.html