Improper Authentication in Fedora - CVE-2020-10754

Vulnerability identifier: #VU34363

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-10754

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to gain access to sensitive information.

It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely.

Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
NetworkManager (Red Hat package)
NetworkManager

Install update from vendor's website.

NetworkManager (Red Hat package) - addressed in versions 1.18.8-1.el7, 1.22.8-5.el8_2
NetworkManager - addressed in versions 1.20.12-1.fc31, 1.22.14-1.fc32

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10754
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44FTVXWKDYIAMOOP2PZMUY3D2QNWAVBZ/

• Improper Authentication in Fedoraproject Fedora
• Red Hat Enterprise Linux 7 update for NetworkManager
• Red Hat Enterprise Linux 8 update for NetworkManager
• Fedora 31 update for NetworkManager
• Fedora 32 update for NetworkManager