Debian alert DLA-4808-1 (network-manager-l2tp)

From:
             
 
Andreans Henriksson <andreas@fatal.se>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4808-1] network-manager-l2tp security update
Date:
             
 
Thu, 01 Oct 2026 12:21:25 +0200
Message-ID:
             
 
<lz4axug7k7b5otwlfxghjp4yidn3wwcuaoz6g6ry3jgyygbvof@gf5urzmgic4g>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4808-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                  Andreans Henriksson
October 01, 2026                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : network-manager-l2tp
Version        : 1.20.8-1+deb12u1
CVE ID         : CVE-2026-19624 CVE-2026-75131 CVE-2026-75883 CVE-2026-93337

Andres Berbescu discovered two vulnerabilities in the L2TP connection
plugin for Network Manager which allowed a local user with permissions
to create/activate personal VPN connections to escalate their privileges
to root.

For Debian 12 bookworm, these problems have been fixed in version
1.20.8-1+deb12u1.

We recommend that you upgrade your network-manager-l2tp packages.

For the detailed security status of network-manager-l2tp please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/network-manag...

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+uHltkZSvnmOJ4zCC8R9xk0TUwYFAmq+NCMACgkQC8R9xk0T
UwZI0A/+Jvr4JpY6HDSLuoVzy5nSOGwIe/+tDdKrlohDOgFKPPCM7B+e2MV8DOs6
3FyOwmviQBj0w4Ot45OLb0pQU77vty3+wVwvzoaud+VX1z3FerG8OOKnF7oHQBcD
pFzb9ZaW88N7DYG+WtSG7N9AlvBBwItExzG+vdbVSTk7Evcb6V4tvyVnk9MlhaN4
z3LKOBS0SOqKGmgR4gqIpsKsSZc4Q3nRjW7OkW1MQujM4iJRHJAsAa/YXL492p43
iykVmf6iAuDutTTKjLN29Gx19oIB14GDCa+LduAWO01xX34w6VpMraCzVnW3pQj0
cDxTnjM139A0efveS2IL3yni/4/iBucQC2W2I2HsYSz3Y8ltY94pFRwd5fH1gWvT
bURlf4fPs/SJJn/p0jNGbLm5ak94jDnAnJbTYxLrokE39lPZd2n7bcIhxAlevrF9
cKkgKQh2JXEgFlHTRZjzNnWFt91Yz3gWMfe768QEDH0P53hR4DOIam7fLp65Pknv
+wmXtIoPn5VNIuZAFq+RdySyL/rGNaS9WXHzkbF8DbqQNI+PT2HKFu54pYyjCB9q
fthM1iE8mXTC7tZIj4vxT3meL6U9jidr605SrlMgnlK2UY+8Re2Dlf3L4PpP80kD
b4m6MmF+1S3+TsDFZBpXd0E1qKvnEHh8yPoH43UIRVH68cS90kU=
=glXa
-----END PGP SIGNATURE-----