Ubuntu alert USN-6851-2 (netplan.io)

From:
             
 
Sudhakar Verma <sudhakar.verma@canonical.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-6851-2] Netplan regression
Date:
             
 
Tue, 02 Jul 2024 15:23:28 +0530
Message-ID:
             
 
<5c89a5bd-cea6-4582-9e4c-91c84328ce74@canonical.com>
==========================================================================
Ubuntu Security Notice USN-6851-2
June 28, 2024

netplan.io regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

USN-6851-1 caused systemctl enable to fail

Software Description:
- netplan.io: Declarative network configuration for various backends

Details:

USN-6851-1 fixed vulnerabilities in Netplan. The update lead to the 
discovery of
a regression in netplan which caused systemctl enable to fail on systems 
without
dbus. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Andreas Hasenack discovered that netplan incorrectly handled the permissions
for netdev files containing wireguard configuration. An attacker could use
this to obtain wireguard secret keys.

It was discovered that netplan configuration could be manipulated into 
injecting
arbitrary commands while setting up network interfaces. An attacker could
use this to execute arbitrary commands or escalate privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   libnetplan1                     1.0-2ubuntu1.2
   netplan-generator               1.0-2ubuntu1.2
   netplan.io                      1.0-2ubuntu1.2

Ubuntu 23.10
   libnetplan0                     0.107-5ubuntu0.4
   netplan-generator               0.107-5ubuntu0.4
   netplan.io                      0.107-5ubuntu0.4

Ubuntu 22.04 LTS
   libnetplan0                     0.106.1-7ubuntu0.22.04.4
   netplan.io                      0.106.1-7ubuntu0.22.04.4

Ubuntu 20.04 LTS
   libnetplan0                     0.104-0ubuntu2~20.04.6
   netplan.io                      0.104-0ubuntu2~20.04.6

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6851-2
   https://ubuntu.com/security/notices/USN-6851-1
   https://launchpad.net/bugs/2071333

Package Information:
   https://launchpad.net/ubuntu/+source/netplan.io/1.0-2ubun...
   https://launchpad.net/ubuntu/+source/netplan.io/0.107-5ub...
   https://launchpad.net/ubuntu/+source/netplan.io/0.106.1-7...
   https://launchpad.net/ubuntu/+source/netplan.io/0.104-0ub...


Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEcfvxe+flLQwqLJFE8LYUYLBMS1YFAmaDzhgFAwAAAAAACgkQ8LYUYLBMS1aS
Ew/+NIM+/BecyfiSc/puUfk9bywiFYzCf4orIBXZIixJZZyh9qjgs0D9GL6tO7hfLi9gYhc4Rx4+
lbbb5ZmuxWW5LF4xF4hJPLEVWTcpVlBRuZhMXpg4oOvlyHsLYMVwlldsTYyCca7yUKGPyr9uuTN0
WCjkVXM+3VYH0AUlqQUZRWoalg3NlNLMwmxDA/oN6YoxiwVnZJx/1d8HA70B/576UkNT02T3F0OP
pEleL7ig74QHivQTzN5mowvVHqR61Cr5+a6wMMjddLUCs8z0Dqv/gKhqgPkCPUXdWA1cnEo7ZpIz
mkg6/5REaMJHRm2xapPg5xbWxsvLZmfRb+CCoDrL5LkFl9pKHVgKx4vKQItHvbymzqoyUQDwZnmf
LRRiZUSDqn6nsv3Fhx7l+QpF9ALIaFRt2SnyvOQjIpU+jTwrC0IMTpc6tlaTbCf55V+B8eUfJWvt
3HYkbTZCLgnazdaX8f1Xd0I0NC7Uwdie2ygLgsEN/NM/2NtRl/fLxdHICjGhtZUHLcNaLG2rQUGs
QvBViEmQlmMYK44Peh+fNbcxXz86ln5Wut4pHJs1HqPL5yYNO9xxWDmf5CH9npop7n6/HerF37tz
TqZzSv10sGl8EFFC/lns84XM3f+5if3LOUMspf/HWoiqvEstiTP0i5zeqBWgDt52v28t4xIA7yCY
Pug=
=0Wfe
-----END PGP SIGNATURE-----


Attachment: None (type=text/plain)