Description: Reject newlines in the CA-File path and the top-level VPN user name
 NetworkManager-vpnc serializes VPN settings into vpnc's line-oriented
 configuration. The 1.2.6 fix for CVE-2018-10900 rejects '\n' and '\r' only in
 the ITEM_TYPE_STRING and ITEM_TYPE_SECRET branches of validate_one_property().
 Two values reach the config writer without that check:
 .
  * CA-File (NM_VPNC_KEY_CA_FILE) is ITEM_TYPE_PATH, whose branch validates only
    that the path is non-empty, absolute and existing (CVE-2026-91841, an
    incomplete fix of CVE-2018-10900);
  * the top-level NMSettingVpn:user-name, written as "Xauth username", is not one
    of the data items walked by nm_vpnc_properties_validate() at all
    (CVE-2026-91840).
 .
 A newline in either value splits into extra vpnc directives such as
 "Password helper", which vpnc runs as root during the xauth exchange, giving a
 local privilege escalation. This adds the missing '\n'/'\r' rejection to the
 ITEM_TYPE_PATH branch and validates the top-level user name.
 .
 Upstream (https://gitlab.gnome.org/Archive/NetworkManager-vpnc) is archived and
 end-of-life, so no upstream fix is expected; this is a Debian-side fix.
Author: Sumit Verma <automationcanadian@gmail.com>
Bug-Debian: https://bugs.debian.org/1148113
Forwarded: not-needed
Last-Update: 2026-11-06
---
--- a/src/nm-vpnc-service.c
+++ b/src/nm-vpnc-service.c
@@ -221,7 +221,13 @@
 		}
 		break;
 	case ITEM_TYPE_PATH:
-		if (   !value
+		if (value && (strchr (value, '\n') || strchr (value, '\r'))) {
+			g_set_error (info->error,
+			             NM_VPN_PLUGIN_ERROR,
+			             NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
+			             _("property “%s” contains a newline character"),
+			             key);
+		} else if (   !value
 		    || !strlen (value)
 		    || !g_path_is_absolute (value)
 		    || !g_file_test (value, G_FILE_TEST_EXISTS)) {
@@ -279,6 +285,20 @@
 		return FALSE;
 	}
 
+	/* The top-level NMSettingVpn:user-name is serialized into the vpnc
+	 * config stream as "Xauth username" but is not one of the data items
+	 * walked above, so it must be checked for embedded newlines here too;
+	 * otherwise it can inject extra vpnc directives (CVE-2026-91840). */
+	if (!*error) {
+		const char *user_name = nm_setting_vpn_get_user_name (s_vpn);
+
+		if (user_name && (strchr (user_name, '\n') || strchr (user_name, '\r')))
+			g_set_error_literal (error,
+			                     NM_VPN_PLUGIN_ERROR,
+			                     NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
+			                     _("the VPN user name contains a newline character"));
+	}
+
 	return *error ? FALSE : TRUE;
 }