CVE-2018-20812: Infoleak
Published Mar 16, 2019
·Updated
An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack (IPv4/IPv6) endpoints.
Affected Software
53 affected components
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r1.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r10.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r11.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r11.1
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r12.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r13.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r2.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r3.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r4.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r5.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r6.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r7.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r8.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r9.0
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r9.1
PulseSecure Pulse Secure Desktop Client Mac Os X=4.0-r9.2
PulseSecure Pulse Secure Desktop Client Macos=5.1-r1.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r1.1
PulseSecure Pulse Secure Desktop Client Macos=5.1-r10.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r11.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r11.1
PulseSecure Pulse Secure Desktop Client Macos=5.1-r12.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r13.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r14.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r2.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r3.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r3.1
PulseSecure Pulse Secure Desktop Client Macos=5.1-r4.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r5.1
PulseSecure Pulse Secure Desktop Client Macos=5.1-r6.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r7.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r8.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r9.0
PulseSecure Pulse Secure Desktop Client Macos=5.1-r9.1
PulseSecure Pulse Secure Desktop Client Macos=5.1r-3.2
PulseSecure Pulse Secure Desktop Client Macos=5.1r-5.0
PulseSecure Pulse Secure Desktop Client Macos=5.3-r1
PulseSecure Pulse Secure Desktop Client Macos=5.3-r1.1
PulseSecure Pulse Secure Desktop Client Macos=5.3-r2
PulseSecure Pulse Secure Desktop Client Macos=5.3-r3
PulseSecure Pulse Secure Desktop Client Macos=5.3-r4
PulseSecure Pulse Secure Desktop Client Macos=5.3-r4.1
PulseSecure Pulse Secure Desktop Client Macos=5.3-r4.2
PulseSecure Pulse Secure Desktop Client Macos=5.3-r5
PulseSecure Pulse Secure Desktop Client Macos=5.3-r5.2
PulseSecure Pulse Secure Desktop Client Macos=5.3-r6
PulseSecure Pulse Secure Desktop Client Macos=5.3-r7
PulseSecure Pulse Secure Desktop Client Macos=9.0-r1
PulseSecure Pulse Secure Desktop Client Macos=9.0-r2
PulseSecure Pulse Secure Desktop Client Macos=9.0-r2.1
PulseSecure Pulse Secure Desktop Client Macos=9.0-r3
PulseSecure Pulse Secure Desktop Client Macos=9.0-r3.2
PulseSecure Pulse Secure Desktop Client Macos=9.0-r4
Event History
Mar 16, 2019
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-20812?
CVE-2018-20812 has a severity rating determined by its potential for information exposure related to IPv6 DNS traffic.
2
How do I fix CVE-2018-20812?
To fix CVE-2018-20812, upgrade to Pulse Secure Desktop Client version 9.0R5 or later.
3
What versions are affected by CVE-2018-20812?
CVE-2018-20812 affects Pulse Secure Desktop Client versions 9.0R1 and earlier, specifically on macOS.
4
What issues does CVE-2018-20812 cause?
CVE-2018-20812 can cause information exposure by allowing IPv6 DNS traffic to bypass the VPN tunnel.
5
Who is affected by CVE-2018-20812?
Users operating dual-stack (IPv4/IPv6) endpoints with the affected versions of Pulse Secure software are at risk from CVE-2018-20812.