---

CVE-2018-10900 - log back

CVE-2018-10900 created at 25 Sep 2019 19:31:40
Severity	+ High
Remote	+ Local
Type	+ Privilege escalation
Description	+ When initiating a VPNC connection, Network Manager spawns a new vpnc process and passes the configuration via STDIN. By injecting a \n character into a configuration parameter, an attacker can coerce Network Manager to set the Password helper option to an attacker controlled executable file.
References	+ https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4 + https://download.gnome.org/sources/NetworkManager-vpnc/1.2/NetworkManager-vpnc-1.2.6.news + https://marc.info/?l=oss-security&m=153207963021874
Notes