CVEvulnerability
CVE-2018-1000135
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-03-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.
Affected configurations
• gnome networkmanager (<= 1.10.2)
• canonical ubuntu linux 16.04
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00005.html lists.opensuse.org
- http://www.securityfocus.com/bid/103478 Third Party Advisory, VDB Entry
- https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1754671 Issue Tracking, Third Party Advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=746422 Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1553634 Issue Tracking, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00005.html lists.opensuse.org
- http://www.securityfocus.com/bid/103478 Third Party Advisory, VDB Entry
- https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1754671 Issue Tracking, Third Party Advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=746422 Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1553634 Issue Tracking, Third Party Advisory