Alerts This Week
Warning Icon 1 626
Alerts This Week
Warning Icon 1 626

Fedora 20: Critical Netcf Update (FEDORA-2015-5910) for DoS Issue

fedora
Calendar Grey May 10, 2015
Dist Fedora Esm H88
Upgrading netcf is crucial for enhancing security and optimizing IPv4 settings in Fedora 20, addressing vulnerabilities and improving network configuration management
Security fix for CVE 2014-8119, as well as adding a few other minor bugfixes and enhancements (support for multiple IPv4 addresses, simultaneous static & dhcp for IPv4)

Summary

Netcf is a library used to modify the network configuration of a

system. Network configurations are expressed in a platform-independent

XML format, which netcf translates into changes to the system's

'native' network configuration files.

Update Information:

Security fix for CVE 2014-8119, as well as adding a few other minor bugfixes and enhancements (support for multiple IPv4 addresses, simultaneous static & dhcp for IPv4)

Topics%20covered

Topics Covered

security advisory critical Fedora security fix network configuration netcf IPv4 support

Change Log

* Wed Apr 8 2015 Laine Stump - 0.2.8-1 - rebase to netcf-0.2.8 - resolve CVE-2014-8119 - Fix build on systems with newer libnl3 that doesn't - support multiple IPv4 addresses in interface config (redhat driver) - allow static IPv4 config simultaneous with DHCPv4 (redhat driver) - recognize IPADDR0/NETMASK0/PREFIX0 - remove extra quotes from IPV6ADDR_SECONDARIES (redhat+suse drivers) - miscellaneous systemd service fixes - use git to apply patches in rpm specfile - allow interleaved elements in interface XML schema - allow element in vlan and bond interfaces - report link state/speed in interface status - change DHCPv6 to DHCPV6C in ifcfg files - max vlan id is 4095, not 4096 - wait for IFF_UP and IFF_RUNNING after calling ifup - don't require IFF_RUNNING for bridge devices - avoid memory leak in debian when listing interfaces - avoid use of uninitialized data when getting mac address (fixes https://bugzilla.redhat.com/show_bug.cgi?id=1046594 ) - limit interface names to IFNAMSIZ-1 characters in length - support systemd for netcf-transaction * Sat May 3 2014 Cole Robinson - 0.2.3-6 - Fix reading bridge stp value (bz #1031053)

References


[ 1 ] Bug #1172176 - CVE-2014-8119 netcf: augeas path expression injection via interface name https://bugzilla.redhat.com/show_bug.cgi?id=1172176

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update netcf' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: netcf
Product: Fedora 20
Version: 0.2.8
Release: 1.fc20
URL: https://fedoraproject.org/wiki/Infrastructure/Fedorahosted-retirement
Summary: Cross-platform network configuration library

Topics%20covered

Topics Covered

security advisory critical Fedora security fix network configuration netcf IPv4 support

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here