CVE-2018-1000135: Infoleak
GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of the GNOME NetworkManager vulnerability?
The vulnerability ID of the GNOME NetworkManager vulnerability is CVE-2018-1000135.
What is the title of the GNOME NetworkManager vulnerability?
The title of the GNOME NetworkManager vulnerability is 'GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability'.
What is the severity of the GNOME NetworkManager vulnerability?
The severity of the GNOME NetworkManager vulnerability is high, with a severity value of 7.5.
What is the affected software of the GNOME NetworkManager vulnerability?
The affected software of the GNOME NetworkManager vulnerability is GNOME NetworkManager version 1.10.2 and earlier, as well as Canonical Ubuntu Linux 16.04.
How can the GNOME NetworkManager vulnerability be fixed?
To fix the GNOME NetworkManager vulnerability, update to a version of GNOME NetworkManager that is later than 1.10.2, and apply any necessary patches or updates provided by the vendor.