Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package NetworkManager for openSUSE:Factory checked in at 2026-09-07 11:26:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/NetworkManager (Old) and /work/SRC/openSUSE:Factory/.NetworkManager.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "NetworkManager" Mon Sep 7 11:26:28 2026 rev:295 rq:1375598 version:1.56.1 Changes: -------- --- /work/SRC/openSUSE:Factory/NetworkManager/NetworkManager.changes 2026-08-01 18:29:46.972696973 +0200 +++ /work/SRC/openSUSE:Factory/.NetworkManager.new.1265/NetworkManager.changes 2026-09-07 11:26:29.696018505 +0200 @@ -1,0 +2,10 @@ +Wed Sep 2 01:59:20 UTC 2026 - Jonathan Kang <[email protected]> + +- Add NetworkManager-CVE-2026-10805.patch: dhclient: reject unsafe + characters in URLs and hostnames (bsc#1267696, CVE-2026-10805, + glfd#NetworkManager/NetworkManager!2426). +- Add NetworkManager-CVE-2026-19685.patch: core: 802.1x: reject + ca-path for private connections (bsc#1276764, CVE-2026-19685, + glfd#NetworkManager/NetworkManager!2513). + +------------------------------------------------------------------- New: ---- NetworkManager-CVE-2026-10805.patch NetworkManager-CVE-2026-19685.patch ----------(New B)---------- New: - Add NetworkManager-CVE-2026-10805.patch: dhclient: reject unsafe characters in URLs and hostnames (bsc#1267696, CVE-2026-10805, New: glfd#NetworkManager/NetworkManager!2426). - Add NetworkManager-CVE-2026-19685.patch: core: 802.1x: reject ca-path for private connections (bsc#1276764, CVE-2026-19685, ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ NetworkManager.spec ++++++ --- /var/tmp/diff_new_pack.SPKOId/_old 2026-09-07 11:26:30.965062900 +0200 +++ /var/tmp/diff_new_pack.SPKOId/_new 2026-09-07 11:26:30.967062970 +0200 @@ -106,6 +106,10 @@ Patch15: 2462.patch # PATCH-FEATURE-SLE NetworkManager-initrd-generator-ip-hcn.patch PED-14534 [email protected] -- handle "ip=hcn" option in nm-initrd-generator, it generates an empty connection Patch16: NetworkManager-initrd-generator-ip-hcn.patch +# PATCH-FIX-UPSTREAM NetworkManager-CVE-2026-10805.patch bsc#1267696, CVE-2026-10805, glfd#NetworkManager/NetworkManager!2426 [email protected] -- dhclient: reject unsafe characters in URLs and hostnames +Patch17: NetworkManager-CVE-2026-10805.patch +# PATCH-FIX-UPSTREAM NetworkManager-CVE-2026-19685.patch bsc#1276764, CVE-2026-19685, glfd#NetworkManager/NetworkManager!2513 [email protected] -- core: 802.1x: reject ca-path for private connections +Patch18: NetworkManager-CVE-2026-19685.patch BuildRequires: c++_compiler BuildRequires: dnsmasq @@ -337,6 +341,8 @@ %if 0%{?sle_version} && 0%{?sle_version} > 160000 %patch -P 16 -p1 %endif +%patch -P 17 -p1 +%patch -P 18 -p1 # Fix server.conf's location, to end up in %%{_defaultdocdir}/%%{name}, # rather then %%{_datadir}/doc/%%{name}/examples: ++++++ NetworkManager-CVE-2026-10805.patch ++++++ >From 60815c81b751259c9f0dd3fd0f337b48b3ee88d5 Mon Sep 17 00:00:00 2001 From: Jan Vaclav <[email protected]> Date: Mon, 8 Jun 2026 13:05:33 +0200 Subject: [PATCH 1/3] libnm-sd-shared: reject urls containing unexpected characters _http_url_is_valid() only rejected non-ASCII bytes (>= 0x80), but accepted control characters, double quotes, and backslashes. These characters can cause injection issues when the URL is pasted into configuration files that interpret them as metacharacters (e.g. quoted strings in dhclient.conf). Reject control characters (< 0x20), double quotes, and backslashes in addition to non-ASCII bytes. (cherry picked from commit 5326760073c06157652b7e0d0865ada2eb0e393b) --- src/libnm-systemd-shared/nm-sd-utils-shared.c | 23 +++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/src/libnm-systemd-shared/nm-sd-utils-shared.c b/src/libnm-systemd-shared/nm-sd-utils-shared.c index dad21596cf..b51faebcf8 100644 --- a/src/libnm-systemd-shared/nm-sd-utils-shared.c +++ b/src/libnm-systemd-shared/nm-sd-utils-shared.c @@ -53,6 +53,20 @@ nm_sd_dns_name_normalize(const char *s) /*****************************************************************************/ +static gboolean +_http_url_is_valid_char(char ch) +{ + if (g_ascii_isalnum(ch)) + return TRUE; + + /* Allow symbols which are allowed by the URL standard, or unlikely + * to be problematic in this scenario. */ + if (strchr(":/%=;&+|^`-._~?#<>{}[]@!$'()*, ", ch) != NULL) + return TRUE; + + return FALSE; +} + static gboolean _http_url_is_valid(const char *url, gboolean only_https) { @@ -69,7 +83,7 @@ _http_url_is_valid(const char *url, gboolean only_https) if (!url[0]) return FALSE; - return !NM_STRCHAR_ANY(url, ch, (guchar) ch >= 128u); + return NM_STRCHAR_ALL(url, ch, _http_url_is_valid_char(ch)); } gboolean @@ -82,12 +96,13 @@ nm_sd_http_url_is_valid_https(const char *url) * assert with http_url_is_valid() that the argument is valid. We thus must make * sure to only pass URLs that are valid according to http_url_is_valid(). * - * This is given, because our nm_sd_http_url_is_valid_https() is more strict - * than http_url_is_valid(). + * This is given, because our nm_sd_http_url_is_valid_https() is more restrictive + * than http_url_is_valid(). The assertion below checks that anything we accept, + * systemd must also accept. * * We only must make sure that this is also correct in the future, when we * re-import systemd code. */ - nm_assert(_http_url_is_valid(url, FALSE) == http_url_is_valid(url)); + nm_assert(!_http_url_is_valid(url, FALSE) || http_url_is_valid(url)); return _http_url_is_valid(url, TRUE); } >From b645048696af720dbaba8d2ef127c2104d931d5b Mon Sep 17 00:00:00 2001 From: Jan Vaclav <[email protected]> Date: Tue, 9 Jun 2026 11:28:15 +0200 Subject: [PATCH 2/3] dhcp/dhclient: validate hostname before pasting it into dhclient config nm_sd_dns_name_is_valid() accepts double quotes, which could break out of the quoted string context in dhclient.conf. Add a check in create_dhclient_config() that rejects hostnames containing characters unsafe for dhclient.conf. (cherry picked from commit ca571c6819e01651be2197abff8eafff22ef80ef) --- src/core/dhcp/nm-dhcp-dhclient.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/core/dhcp/nm-dhcp-dhclient.c b/src/core/dhcp/nm-dhcp-dhclient.c index 7e00599cd8..99421b35fd 100644 --- a/src/core/dhcp/nm-dhcp-dhclient.c +++ b/src/core/dhcp/nm-dhcp-dhclient.c @@ -221,6 +221,16 @@ find_existing_config(NMDhcpDhclient *self, int addr_family, const char *iface, c return NULL; } +static gboolean +_dhclient_hostname_is_valid(const char *hostname) +{ + for (const char *p = hostname; *p; p++) { + if (!g_ascii_isalnum(*p) && !NM_IN_SET(*p, '-', '.')) + return FALSE; + } + return TRUE; +} + /* NM provides interface-specific options; thus the same dhclient config * file cannot be used since DHCP transactions can happen in parallel. * Since some distros don't have default per-interface dhclient config files, @@ -251,6 +261,12 @@ create_dhclient_config(NMDhcpDhclient *self, g_return_val_if_fail(iface != NULL, NULL); + if (hostname && !_dhclient_hostname_is_valid(hostname)) { + _LOGW("hostname '%s' contains unsafe characters for dhclient config, will be ignored", + hostname); + hostname = NULL; + } + new_path = g_strdup_printf(NMSTATEDIR "/dhclient%s-%s.conf", _addr_family_to_path_part(addr_family), iface); >From bfd5d50ec4981047218cab8d473653a12b92f62c Mon Sep 17 00:00:00 2001 From: Josephine Pfeiffer <[email protected]> Date: Tue, 23 Jun 2026 14:01:41 +0200 Subject: [PATCH 3/3] systemd: test nm_sd_http_url_is_valid_https() character rejection Add a regression test that the validator rejects characters that could break out of that string (double quote, backslash, control bytes, non-ASCII) while still accepting normal https URLs. (cherry picked from commit 58c0fe9d84892621de19adf4234894f34221f92a) --- src/core/tests/test-systemd.c | 37 +++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/src/core/tests/test-systemd.c b/src/core/tests/test-systemd.c index 1b0b7f6536..09481a64ac 100644 --- a/src/core/tests/test-systemd.c +++ b/src/core/tests/test-systemd.c @@ -83,6 +83,42 @@ test_sd_event(void) /*****************************************************************************/ +static void +test_http_url_is_valid_https(void) +{ + /* CVE-2026-10805: connection.mud-url is pasted verbatim into the dhclient + * config inside a quoted string ("send mudurl \"%s\";"). This function + * gates the property at verify() time, so it must reject characters that + * break out of the quotes or inject config syntax. */ +#define _assert_valid(url) g_assert(nm_sd_http_url_is_valid_https("" url)) +#define _assert_invalid(url) g_assert(!nm_sd_http_url_is_valid_https("" url)) + + _assert_valid("https://example.com/mud.json";); + _assert_valid("https://example.com";); + _assert_valid("https://example.com/a?b=c&d=e#frag";); + _assert_valid("https://[2001:db8::1]/x";); + _assert_valid("https://[email protected]/~p/(a)*,;=+!$'"); + _assert_valid("https://user:[email protected]/p%20q?x=%2F";); + + _assert_invalid("http://example.com";); + _assert_invalid("ftp://example.com";); + _assert_invalid("example.com"); + _assert_invalid(""); + _assert_invalid("https://";); + + _assert_invalid("https://example.com/\"";); /* breaks out of the quoted string */ + _assert_invalid("https://example.com/\\";); /* escapes the following char */ + _assert_invalid("https://example.com/\n";); + _assert_invalid("https://example.com/\t";); + _assert_invalid("https://example.com/a\x01b";); + _assert_invalid("https://example.com/\xc3\xa4";); /* non-ASCII */ + +#undef _assert_valid +#undef _assert_invalid +} + +/*****************************************************************************/ + NMTST_DEFINE(); int @@ -91,6 +127,7 @@ main(int argc, char **argv) nmtst_init(&argc, &argv, TRUE); g_test_add_func("/systemd/sd-event", test_sd_event); + g_test_add_func("/systemd/http-url-is-valid-https", test_http_url_is_valid_https); return g_test_run(); } ++++++ NetworkManager-CVE-2026-19685.patch ++++++ >From 8536539133e99691222dba899a65d91fd608b064 Mon Sep 17 00:00:00 2001 From: Josephine Pfeiffer <[email protected]> Date: Fri, 14 Aug 2026 12:10:20 +0200 Subject: [PATCH] core: 802.1x: reject ca-path for private connections A private connection's 802.1X files were passed to the supplicant as blobs. Directories cannot be blobs, so ca-path and phase2-ca-path still emitted a raw path. With no ca-cert set, wpa_supplicant trusts that directory alone and still reports the server as verified, so the owner of the profile picks the CA that authenticates the network. Use g_set_error() rather than the sibling ca-cert's g_return_val_if_fail(), which leaves the GError unset while callers log error->message. Fixes: e85cc46d0b36 ('core: pass certificates as blobs to supplicant for private connections') Fixes CVE-2026-19685 https://issues.redhat.com/browse/RHEL-189084 (cherry picked from commit a8e87381a3e70060abd721d9a347f42b2ba68e6e) --- src/core/supplicant/nm-supplicant-config.c | 18 +++ .../supplicant/tests/test-supplicant-config.c | 109 ++++++++++++++++++ 2 files changed, 127 insertions(+) diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c index 233afe4894..cad1dd05cd 100644 --- a/src/core/supplicant/nm-supplicant-config.c +++ b/src/core/supplicant/nm-supplicant-config.c @@ -1615,6 +1615,15 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self, path = nm_setting_802_1x_get_ca_path(setting); path = ca_path_override ?: path; if (path) { + /* A directory cannot be passed as a blob, so private connections are + * limited to the system CA store */ + if (priv->private_user && !ca_path_override) { + g_set_error_literal(error, + NM_SUPPLICANT_ERROR, + NM_SUPPLICANT_ERROR_CONFIG, + "ca-path is not supported for private connections"); + return FALSE; + } if (!add_string_val(self, path, "ca_path", FALSE, NULL, error)) return FALSE; } @@ -1623,6 +1632,15 @@ nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self, path = nm_setting_802_1x_get_phase2_ca_path(setting); path = ca_path_override ?: path; if (path) { + /* A directory cannot be passed as a blob, so private connections are + * limited to the system CA store */ + if (priv->private_user && !ca_path_override) { + g_set_error_literal(error, + NM_SUPPLICANT_ERROR, + NM_SUPPLICANT_ERROR_CONFIG, + "phase2-ca-path is not supported for private connections"); + return FALSE; + } if (!add_string_val(self, path, "ca_path2", FALSE, NULL, error)) return FALSE; } diff --git a/src/core/supplicant/tests/test-supplicant-config.c b/src/core/supplicant/tests/test-supplicant-config.c index 416fe0054f..8a14999093 100644 --- a/src/core/supplicant/tests/test-supplicant-config.c +++ b/src/core/supplicant/tests/test-supplicant-config.c @@ -914,6 +914,113 @@ test_suppl_cap_mask(void) /*****************************************************************************/ +#define EVIL_CA "/home/user/evil-ca" + +static NMSetting8021x * +generate_8021x_peap_setting(const char *ca_path, const char *phase2_ca_path) +{ + NMSetting8021x *s_8021x; + + s_8021x = (NMSetting8021x *) nm_setting_802_1x_new(); + nm_setting_802_1x_add_eap_method(s_8021x, "peap"); + g_object_set(s_8021x, + NM_SETTING_802_1X_CA_PATH, + ca_path, + NM_SETTING_802_1X_PHASE2_CA_PATH, + phase2_ca_path, + NULL); + + return s_8021x; +} + +static void +test_8021x_ca_path_private_connection(void) +{ + gs_free char *uuid = nm_utils_uuid_generate(); + gpointer logging = nmtst_logging_disable(TRUE); + + /* A private connection must not pick the CA directory handed to the + * supplicant. The GError must be set: callers log error->message + * unconditionally when the config fails to build. */ + { + gs_unref_object NMSupplicantConfig *config = NULL; + gs_unref_object NMSetting8021x *s_8021x = NULL; + gs_unref_variant GVariant *dict = NULL; + gs_unref_bytes GBytes *evil = g_bytes_new(EVIL_CA, strlen(EVIL_CA)); + gs_free_error GError *error = NULL; + + s_8021x = generate_8021x_peap_setting(EVIL_CA, NULL); + config = nm_supplicant_config_new(NM_SUPPL_CAP_MASK_NONE, "user"); + g_assert( + !nm_supplicant_config_add_setting_8021x(config, s_8021x, uuid, 0, FALSE, NULL, &error)); + g_assert_error(error, NM_SUPPLICANT_ERROR, NM_SUPPLICANT_ERROR_CONFIG); + + dict = nm_supplicant_config_to_variant(config); + g_assert(!validate_opt("ca-path", dict, "ca_path", NM_SUPPL_OPT_TYPE_BYTES, evil)); + } + + { + gs_unref_object NMSupplicantConfig *config = NULL; + gs_unref_object NMSetting8021x *s_8021x = NULL; + gs_unref_variant GVariant *dict = NULL; + gs_unref_bytes GBytes *evil = g_bytes_new(EVIL_CA, strlen(EVIL_CA)); + gs_free_error GError *error = NULL; + + s_8021x = generate_8021x_peap_setting(NULL, EVIL_CA); + config = nm_supplicant_config_new(NM_SUPPL_CAP_MASK_NONE, "user"); + g_assert( + !nm_supplicant_config_add_setting_8021x(config, s_8021x, uuid, 0, FALSE, NULL, &error)); + g_assert_error(error, NM_SUPPLICANT_ERROR, NM_SUPPLICANT_ERROR_CONFIG); + + dict = nm_supplicant_config_to_variant(config); + g_assert(!validate_opt("phase2-ca-path", dict, "ca_path2", NM_SUPPL_OPT_TYPE_BYTES, evil)); + } + + /* System-wide connections are only modifiable by an authorized user, so + * they may still name a directory. */ + { + gs_unref_object NMSupplicantConfig *config = NULL; + gs_unref_object NMSetting8021x *s_8021x = NULL; + gs_unref_variant GVariant *dict = NULL; + gs_unref_bytes GBytes *dir = g_bytes_new("/some/ca-dir", NM_STRLEN("/some/ca-dir")); + gs_free_error GError *error = NULL; + + s_8021x = generate_8021x_peap_setting("/some/ca-dir", NULL); + config = nm_supplicant_config_new(NM_SUPPL_CAP_MASK_NONE, NULL); + g_assert( + nm_supplicant_config_add_setting_8021x(config, s_8021x, uuid, 0, FALSE, NULL, &error)); + g_assert_no_error(error); + + dict = nm_supplicant_config_to_variant(config); + g_assert(validate_opt("ca-path", dict, "ca_path", NM_SUPPL_OPT_TYPE_BYTES, dir)); + } + + /* system-ca-certs overrides the user's directory instead of failing. */ + if (!g_file_test(SYSTEM_CA_PATH, G_FILE_TEST_IS_DIR)) { + g_test_skip("SYSTEM_CA_PATH is not a directory"); + } else { + gs_unref_object NMSupplicantConfig *config = NULL; + gs_unref_object NMSetting8021x *s_8021x = NULL; + gs_unref_variant GVariant *dict = NULL; + gs_unref_bytes GBytes *sys = g_bytes_new(SYSTEM_CA_PATH, NM_STRLEN(SYSTEM_CA_PATH)); + gs_free_error GError *error = NULL; + + s_8021x = generate_8021x_peap_setting(EVIL_CA, NULL); + g_object_set(s_8021x, NM_SETTING_802_1X_SYSTEM_CA_CERTS, TRUE, NULL); + config = nm_supplicant_config_new(NM_SUPPL_CAP_MASK_NONE, "user"); + g_assert( + nm_supplicant_config_add_setting_8021x(config, s_8021x, uuid, 0, FALSE, NULL, &error)); + g_assert_no_error(error); + + dict = nm_supplicant_config_to_variant(config); + g_assert(validate_opt("ca-path", dict, "ca_path", NM_SUPPL_OPT_TYPE_BYTES, sys)); + } + + nmtst_logging_reenable(logging); +} + +/*****************************************************************************/ + NMTST_DEFINE(); int @@ -930,6 +1037,8 @@ main(int argc, char **argv) g_test_add_func("/supplicant-config/wifi-sae", test_wifi_sae); g_test_add_func("/supplicant-config/test_suppl_cap_mask", test_suppl_cap_mask); g_test_add_func("/supplicant-config/wifi-eap-suite-b-192", test_wifi_eap_suite_b_generation); + g_test_add_func("/supplicant-config/8021x-ca-path-private-connection", + test_8021x_ca_path_private_connection); return g_test_run(); } ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.SPKOId/_old 2026-09-07 11:26:31.214071612 +0200 +++ /var/tmp/diff_new_pack.SPKOId/_new 2026-09-07 11:26:31.220071821 +0200 @@ -1,6 +1,7 @@ -mtime: 1785282036 -commit: 8764c49842e9c036b43c68a9698d4dff935efbe64efee941a814f28fe27fde55 +mtime: 1788400178 +commit: d740b87e22f67cabf887bb5a120a5b0d248b0d4a87a7d433de5153a2982efe07 url: https://src.opensuse.org/GNOME/NetworkManager -revision: 8764c49842e9c036b43c68a9698d4dff935efbe64efee941a814f28fe27fde55 +revision: d740b87e22f67cabf887bb5a120a5b0d248b0d4a87a7d433de5153a2982efe07 +trackingbranch: factory projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-03 03:49:38.000000000 +0200 @@ -0,0 +1,5 @@ +*.obscpio +*.osc +_build.* +.pbuild +osc-collab.*
