[Pkg-utopia-maintainers] Bug#1148113: network-manager-vpnc: CVE-2026-91840 CVE-2026-91841 - patch (newline validation)

[Sumit Verma]

Hi Salvatore,

Sorry about that: my previous mail went out in Gmail confidential mode, so
it did not reach the bug log in readable form. Here it is again as plain
mail, with the patch attached.

A patch for both CVEs is attached. Upstream is archived and marked end of
life, so there is no upstream fix to pull; this is a Debian-side change.

Root cause
----------
nm-vpnc-service serialises VPN settings into vpnc's line-oriented config.
validate_one_property() rejects newline and carriage return, but only in
the ITEM_TYPE_STRING and ITEM_TYPE_SECRET branches (the 1.2.6 fix for
CVE-2018-10900). Two values reach the writer without that check:

- CA-File (ITEM_TYPE_PATH): its branch checks only that the path is
non-empty, absolute and existing. A newline in the path splits into
extra vpnc directives. This is CVE-2026-91841, described upstream as an
incomplete fix of CVE-2018-10900.

- The top-level NMSettingVpn:user-name: nm_vpnc_properties_validate()
walks the data items and the secrets, but not the connection's
user-name, which nm_vpnc_config_write() writes out as "Xauth username".
This is CVE-2026-91840.

A newline in either value injects directives such as "Password helper",
which vpnc runs as root during the xauth exchange, so an unprivileged
local user who can activate a private profile gets root. The reporter's
writeup in the two upstream issues has the full chain.

I confirmed both gaps by reading the source of 1.2.8-4 (bookworm), 1.4.0-2
(trixie) and 1.4.0-4 (sid/forky): in all three the ITEM_TYPE_PATH branch
has no newline check, and the user-name is written without validation.

The patch
---------
It adds the missing newline rejection to the ITEM_TYPE_PATH branch and
validates the top-level user-name in nm_vpnc_properties_validate(), using
the same strchr check the STRING/SECRET branch already uses. The attached
patch is one file (src/nm-vpnc-service.c). It applies cleanly to 1.4.0-2
and 1.4.0-4, and with a -3 line offset to 1.2.8-4.

What I did and did not test
---------------------------
The patched source compiles cleanly (no warnings in the file) against the
libnm and glib headers, for both the 1.2.8 and 1.4.0 trees. I did not run
a full package build: automake and some of the -dev build-dependencies
are not currently installable here. I also did not build an exploit to
demonstrate the escalation; the fix mirrors the existing, already-accepted
CVE-2018-10900 rejection in the same function, and legitimate paths and
user names contain no newlines.

Given that upstream is EOL and GNOME's advisory recommends migrating away
from this plugin, you may prefer to remove the package rather than carry a
patch. Either way the tracker entries have no fix reference, and this at
least gives a minimal one if you keep the package.

Regards,
Sumit Verma
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-utopia-maintainers/attachments/20261108/c5fcdeab/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: CVE-2026-91840-91841-nm-vpnc-newline.patch
Type: text/x-patch
Size: 2635 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-utopia-maintainers/attachments/20261108/c5fcdeab/attachment.bin>