Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A privilege escalation flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. The construct_pppd_args() function in nm-sstp-service.c concatenates user-controlled connection profile fields, including ca-cert and proxy settings, into the pty argument passed to pppd without properly shell-escaping them. Because pppd invokes this pty command through /bin/sh -c while running as root, a local unprivileged user can embed shell metacharacters in these connection profile fields to have arbitrary commands executed with root privileges when the malicious VPN connection is activated.