-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 30 Sep 2026 10:58:52 +0200
Source: network-manager-l2tp
Architecture: source
Version: 1.20.8-1+deb12u1
Distribution: bookworm-security
Urgency: high
Maintainer: Douglas Kosovic <doug@uq.edu.au>
Changed-By: Andreas Henriksson <andreas@fatal.se>
Changes:
network-manager-l2tp (1.20.8-1+deb12u1) bookworm-security; urgency=high
.
* Non-maintainer upload by the LTS Team.
* Security fixes for local privilege escalation to root involving:
- Injection of '\n' or '\r' control characters written into
/run/nm-l2tp-<uuid>/ipsec.conf (CVE-2026-19624)
- Quote break-out via the 'user' string property written into
/run/nm-l2tp-<uuid>/ppp-options (CVE-2026-75131)
- Partial strtol() on mtu/mru/mrru properties allow trailing string
injection written into /run/nm-l2tp-<uuid>/ppp-options (CVE-2026-75883)
- The above also adresses CVE-2026-93337 / GHSA-rp84-8h2r-5xc3.
* As a pre-condition to the above security fixes, the following additional
bug-fixes has been included as well:
- fix missing ppp user option
- add support for usernames that contains a space
(changes swallowed by CVE fixes above for proper quoting of 'user')
- immediately leave validate_one_property() upon validation error
(avoids gerror output)
Checksums-Sha1:
57feb0cef2d1a29d7526c9f11d864f921af55670 2569 network-manager-l2tp_1.20.8-1+deb12u1.dsc
d87b4f54f8f42a59cd00d8690b7a3ea0517db503 487316 network-manager-l2tp_1.20.8.orig.tar.xz
53bce5524d738b62774c6b855067df0bb984a9ef 833 network-manager-l2tp_1.20.8.orig.tar.xz.asc
f4315353b13b672b071263236665b610b2d49669 13872 network-manager-l2tp_1.20.8-1+deb12u1.debian.tar.xz
3d3635bd026a4444aa6862f98605ce1b27bd0813 15168 network-manager-l2tp_1.20.8-1+deb12u1_source.buildinfo
Checksums-Sha256:
e9573aca9fa588de2c11b0b2f2c9e128b8dcdf53c98e558f1211f51b47b2e3fd 2569 network-manager-l2tp_1.20.8-1+deb12u1.dsc
9f0efd637acbca57e84dcc693a47804b18723764e26fb4955df6b4ecdd3fbac2 487316 network-manager-l2tp_1.20.8.orig.tar.xz
f244774711753391dea3ac486e7e49b12efeed8e983bb48dbdb618112589358b 833 network-manager-l2tp_1.20.8.orig.tar.xz.asc
2bde5fbf716f38883a62d56878974cc239c5ab75760c2449a4b6f6172885ebe8 13872 network-manager-l2tp_1.20.8-1+deb12u1.debian.tar.xz
e529264ec6ee10160258fa6b43d785995859d600c57f8e8912f28da43d17211f 15168 network-manager-l2tp_1.20.8-1+deb12u1_source.buildinfo
Files:
720e87661e5052eda3dc1cc82fc77939 2569 net optional network-manager-l2tp_1.20.8-1+deb12u1.dsc
214de227c3aa2e844cdb5d84cb1edff8 487316 net optional network-manager-l2tp_1.20.8.orig.tar.xz
266845e3ee56180559ec14894d3536c3 833 net optional network-manager-l2tp_1.20.8.orig.tar.xz.asc
7cd197badcc287c8bb1821d8b1de5f71 13872 net optional network-manager-l2tp_1.20.8-1+deb12u1.debian.tar.xz
7c31421032074494df571dd50ca3416d 15168 net optional network-manager-l2tp_1.20.8-1+deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE+uHltkZSvnmOJ4zCC8R9xk0TUwYFAmq+I50ACgkQC8R9xk0T
UwaKLw/9HR9NEgDxcdm0R8TpkWfyfpWEl3H5x594qNpQyRKm+T9RpvXnJ6hE0XxE
8eeX8hVpwPQItD4jgCBpWZ2B3Q/2LZxKE4/yFpwvUrI2V7XQpY1RnM9NmcOn69yb
9D5jPGPhaOk9iykeZ/oAp6tslqHGeUOAJiUWaSlJNS7MbzOrc0W9EnWmKaBrXh47
3EMyWPXawR5NeM+6K3CRsEVWLiJTbF7QYxIXH2gl8xEnmZQd2PbJx8eyuW7DU05Q
n7895HU9xA34usHnw+gP8mtqEIaTpdW+x+ovnAGJ4RiAHZnUxMjij31SOs6LuLaK
TPjZikA0g/jl2Yim0Eu8BWJnkyVTejfS7+AlWJVq6jhZ0kUuG1sTvNa4G7YA9AcU
fljoU39kWgeMbek27WDKIFKWu8GfnKwjHyKL2wRHHC3KQzaHJbWQfYJHyfl59p3l
Quj8ZmypqJSSE20MLx6LMmE8Ij8njeKqvCJlgPAUvvWNvBvr7OGQVgeq2XfreJ6m
H/fIz5cmhPJ4FH6OtI4hLsMMHTWTOKQD2XPwUhSTp09eq1xoO2QPsarrxRVnt6Xl
Ml1Oa9UTe1hBHsHnGotbhu9Rm7guDp07CBYMjfhPK+iSHydK8xeZ1tTGCWoLwhuH
U07ycLGu9kVvPnj37Cuj5vy0mqJfnCKgpofyfhgYBpMYXeWIxU4=
=oq0G
-----END PGP SIGNATURE-----
