Updated netcf packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The netcf packages contain a library for modifying the network configuration of a system. Network configuration is expressed in a platform-independent XML format, which netcf translates into changes to the system's 'native' network configuration files.

A denial of service flaw was found in netcf. A specially crafted interface name could cause an application using netcf (such as the libvirt daemon) to crash. (CVE-2014-8119)

This issue was discovered by Hao Liu of Red Hat.

The netcf packages have been upgraded to upstream version 0.2.8, which provides a number of bug fixes and enhancements over the previous version. (BZ#1206680)

Users of netcf are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Security fix for CVE-2014-8119, as well as adding a few other minor bugfixes and enhancements (support for multiple IPv4 addresses, simultaneous static & dhcp for IPv4)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2248 advisory.

    [0.2.8-1]
    - Rebase to netcf-0.2.8
     - resolve rhbz#1165965 - CVE-2014-8119
     - resolve rhbz#1159000
     - support multiple IPv4 addresses in interface config (redhat driver)
     - resolve rhbz#1113983
     - allow static IPv4 config simultaneous with DHCPv4 (redhat driver)
     - resolve rhbz#1170941
     - remove extra quotes from IPV6ADDR_SECONDARIES (redhat+suse drivers)
     - resolve rhbz#1090011
     - limit names of new interfaces to IFNAMSIZ characters
     - resolve rhbz#761246
     - properly parse ifcfg files with comments past column 1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes an untrusted argument escaping problem (CVE-2014-8119) :

  - new API - aug_escape_name() - which can be used to     escape untrusted inputs before using them as part of     path expressions

  - aug_match() is changed to return properly escaped output

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXBA:2015-387:01 advisory.

  - The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service     (application crash) via vectors involving augeas path expressions. (CVE-2014-8119)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has netcf packages installed that are affected by a vulnerability:

  - The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service     (application crash) via vectors involving augeas path expressions. (CVE-2014-8119)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A denial of service flaw was found in netcf. A specially crafted interface name could cause an application using netcf (such as the libvirt daemon) to crash. (CVE-2014-8119)

The netcf packages have been upgraded to upstream version 0.2.8, which provides a number of bug fixes and enhancements over the previous version.

This update for augeas fixes the following issues: Security issues fixed :

  - CVE-2017-7555: Fix a memory corruption bug could have     lead to arbitrary code execution by passing crafted     strings that would be mis-handled by parse_name()     (bsc#1054171).

  - CVE-2014-8119: Fix improper handling of escaped strings     leading to memory corruption (bsc#925225).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06, has netcf packages installed that are affected by a vulnerability:

  - The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service     (application crash) via vectors involving augeas path expressions. (CVE-2014-8119)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-621:01 advisory.

    Netcf is a library used to modify the network configuration of a     system. Network configurations are expressed in a platform-independent     XML format, which netcf translates into changes to the system's     'native' network configuration files.
    Security issues fixed with this release:
    CVE-2014-8119
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
87147	CentOS 7 : netcf (CESA-2015:2248)	Nessus	CentOS Local Security Checks	12/2/2015	1/4/2021	high
83149	Fedora 22 : netcf-0.2.8-1.fc22 (2015-5885)	Nessus	Fedora Local Security Checks	4/30/2015	1/11/2021	high
83311	Fedora 20 : netcf-0.2.8-1.fc20 (2015-5910)	Nessus	Fedora Local Security Checks	5/11/2015	1/11/2021	high
87033	Oracle Linux 7 : netcf (ELSA-2015-2248)	Nessus	Oracle Linux Local Security Checks	11/24/2015	10/22/2024	high
83310	Fedora 21 : netcf-0.2.8-1.fc21 (2015-5872)	Nessus	Fedora Local Security Checks	5/11/2015	1/11/2021	high
84874	SUSE SLED12 / SLES12 Security Update : augeas (SUSE-SU-2015:1249-1)	Nessus	SuSE Local Security Checks	7/20/2015	1/6/2021	high
291418	MiracleLinux 4 : netcf-0.2.4-3.AXS4 (AXBA:2015-387:01)	Nessus	Miracle Linux Local Security Checks	1/19/2026	1/19/2026	high
301238	NewStart CGSL MAIN 6.06 (SP) : netcf Vulnerability (NS-SA-2026-0026)	Nessus	NewStart CGSL Local Security Checks	3/6/2026	3/6/2026	high
86979	RHEL 7 : netcf (RHSA-2015:2248)	Nessus	Red Hat Local Security Checks	11/20/2015	10/24/2019	high
87563	Scientific Linux Security Update : netcf on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	12/22/2015	1/14/2021	high
107291	SUSE SLES11 Security Update : augeas (SUSE-SU-2018:0653-1)	Nessus	SuSE Local Security Checks	3/12/2018	10/24/2025	critical
266229	NewStart CGSL MAIN 6.06 : netcf Vulnerability (NS-SA-2025-0230)	Nessus	NewStart CGSL Local Security Checks	9/30/2025	9/30/2025	high
289962	MiracleLinux 7 : netcf-0.2.8-1.el7 (AXSA:2015-621:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
86540	SUSE SLED11 / SLES11 Security Update : augeas (SUSE-SU-2015:1792-1)	Nessus	SuSE Local Security Checks	10/22/2015	1/6/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

critical

high

high

high