PT-2018-14085 · Telegram+1 · Telegram Desktop+1

Dhiraj Mishra · Published 2018-09-28 · Updated 2019-10-03 · CVE-2018-17613

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Telegram Desktop (aka tdesktop) version 1.3.16 alpha

Description The issue concerns the transmission of sensitive data in cleartext when a specific setting is enabled. Specifically, when "Use proxy" is enabled, credentials and application data are sent in cleartext over the SOCKS5 protocol.

Recommendations For Telegram Desktop (aka tdesktop) version 1.3.16 alpha, consider disabling the "Use proxy" setting until a fix is available to prevent credentials and application data from being sent in cleartext.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-17613

Affected Products

Debian

Telegram Desktop

References · 9

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-17613 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17613 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17613 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17613 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-17613 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-17613 · Vendor Advisory
• https://seclists.org/oss-sec/2018/q3/280 · Note
• https://inputzero.io/2018/09/telegram-share-password-in-cleartext.html · Note