7.8
High
CVE-2026-19624 A flaw was found in NetworkManager-l2tp
Description
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fedora 1.52 | 1.52.0 → < 1.52.4 | 1.52.4 |
| Extra Packages for Enterprise Linux (EPEL) 1.20 | 1.20.0 → < 1.20.24 | 1.20.24 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- bodhi.fedoraproject.org bodhi.fedoraproject.org
- linnemanlabs.com linnemanlabs.com
Timeline
- Published
- Last modified
Other CVEs of Fedora
The 83 CVEs of Fedora →
CVE-2026-94422
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass…
8.8
High
CVE-2026-19816
A flaw was found in PackageKit
7.1
High
CVE-2023-4235
A flaw was found in ofono, an Open Source Telephony on Linux
8.1
High
CVE-2023-4234
A flaw was found in ofono, an Open Source Telephony on Linux
8.1
High