CVE-2018-17780: Infoleak
First published: Sat Sep 29 2018(Updated: )
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Telegram Telegram Desktop | =1.3.14 | |
| Telegram Telegram Messenger | =3.3.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-17780?
CVE-2018-17780 is a vulnerability in Telegram Desktop and Telegram Messenger that leaks end-user public and private IP addresses during a call.
How does CVE-2018-17780 affect Telegram Desktop and Telegram Messenger?
CVE-2018-17780 allows P2P connections from clients outside of the My Contacts list, leading to the leakage of end-user IP addresses.
What is the severity of CVE-2018-17780?
CVE-2018-17780 has a severity rating of medium, with a value of 6.5.
How can I fix CVE-2018-17780?
To fix CVE-2018-17780, update Telegram Desktop to version 1.3.15 or later, and update Telegram Messenger to version 3.3.0.1 or later.
Where can I find more information about CVE-2018-17780?
For more information about CVE-2018-17780, you can refer to the following sources: [SecurityFocus](http://www.securityfocus.com/bid/105521) and [InputZero](https://www.inputzero.io/2018/09/bug-bounty-telegram-cve-2018-17780.html).
- collector/nvd-index
- vendor/telegram
- product/telegram desktop
- canonical/telegram telegram desktop
- product/telegram messenger
- canonical/telegram telegram messenger