First published: Sat Sep 29 2018(Updated: )
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Telegram Telegram Desktop | =1.3.14 | |
Telegram Telegram Messenger | =3.3.0.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-17780 is a vulnerability in Telegram Desktop and Telegram Messenger that leaks end-user public and private IP addresses during a call.
CVE-2018-17780 allows P2P connections from clients outside of the My Contacts list, leading to the leakage of end-user IP addresses.
CVE-2018-17780 has a severity rating of medium, with a value of 6.5.
To fix CVE-2018-17780, update Telegram Desktop to version 1.3.15 or later, and update Telegram Messenger to version 3.3.0.1 or later.
For more information about CVE-2018-17780, you can refer to the following sources: [SecurityFocus](http://www.securityfocus.com/bid/105521) and [InputZero](https://www.inputzero.io/2018/09/bug-bounty-telegram-cve-2018-17780.html).