RHSA-2021:1574 - Security Advisory

Topic

An update for NetworkManager and libnma is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.

The following packages have been upgraded to a later upstream version: NetworkManager (1.30.0). (BZ#1878783)

Security Fix(es):

• NetworkManager: Profile with match.path setting triggers crash (CVE-2021-20297)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64

Fixes

• BZ - 1436535 - [RFE] Support port mirroring (SPAN)
• BZ - 1623084 - [RFE] - make Network Manager work best of public clouds.
• BZ - 1766944 - Hostname not configured through reverse-DNS query
• BZ - 1813334 - [RFE] add library for handling profiles in keyfile format
• BZ - 1818697 - Vlan over bond is not active after first boot
• BZ - 1861296 - RFE: better handle left-over configuration in OVS created by NetworkManager
• BZ - 1866227 - [RFE] Add support for external_ids for OVS bridges and interfaces in libnm
• BZ - 1867997 - Add manual page for nm-cloud-setup
• BZ - 1869079 - Activate a profile of unmanaged interface does not remove it from bridge port
• BZ - 1870691 - Cannot change bond mode for bond created by iproute
• BZ - 1876577 - Modifying bond active slave fails over "failed: Can't reapply 'active_slave' bond option"
• BZ - 1878783 - Rebase NetworkManager to latest upstream release in RHEL 8.4
• BZ - 1882380 - Please allow `NM.Device.get_applied_connection_async()` to run by non-privilege user
• BZ - 1883958 - initrd: can't disable NICs during boot
• BZ - 1886336 - nmcli ignores /etc/terminal-colors.d/nmcli.scheme
• BZ - 1887523 - [bond] The packets_per_slave option should be only valid under balance-rr mode
• BZ - 1888051 - NetworkManager needs to pass bridge master to wpa_supplicant when Wlan is part of bridge
• BZ - 1888229 - we need to clean dns cache when bringing down connection
• BZ - 1888348 - Bond port been deattached when attaching this bond to a new linux bridge
• BZ - 1894839 - NetworkManager breaks RHEL-8.4.0 Development compose installability on ppc64le.
• BZ - 1898294 - initrd: vlan DEV_PLUS_VID form can throw off ip= parsing
• BZ - 1900536 - [NMCI] NetworkManager build with assertions crashes with dracut network-legacy module
• BZ - 1901523 - RFE: Support configuring VETH interfaces
• BZ - 1903175 - initrd: defaulting to DHCP on vlan sub interfaces
• BZ - 1904099 - Hardware type 00 no longer accepted via BOOTIF option in 8.3
• BZ - 1915457 - RFE: Support vlan+srcmac tx hashing option
• BZ - 1915493 - Support for ip= boot argument with static IP and no interface specified
• BZ - 1917713 - Segfault in NetworkManager
• BZ - 1917773 - NetworkManager doesn't initialize an interface, reports startup complete when booting for the first time
• BZ - 1920838 - [RHEL-8.4] nm-cloud-setup cannot remove unassigned ip from interface
• BZ - 1921107 - NetworkManager fails to configure firewalld for ovs-port
• BZ - 1923248 - Random profile activation error NM_ACTIVE_CONNECTION_STATE_REASON_UNKNOWN
• BZ - 1923999 - When adding host to RHV-M with LACP bond, '"ad_actor_system=00:00:00:00:00:00' is seen in messages [rhel-8.3.0.z]] again
• BZ - 1925123 - man nm-settings-ifcfg-rh does not mention NETMASK option
• BZ - 1937723 - setting MTU on VLAN subinterface of bonded interface is ignored
• BZ - 1943282 - CVE-2021-20297 NetworkManager: Profile with match.path setting triggers crash

CVEs

• CVE-2021-20297

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/