PT-2018-3462 · Gnome+2 · Networkmanager-Gnome+2

David Woodhouse · Published 2018-02-09 · Updated 2024-06-15 · CVE-2018-1000135

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GNOME NetworkManager version 1.10.2 and earlier

Description: The issue is related to an information exposure in the DNS resolver of GNOME NetworkManager, which can lead to private DNS queries being leaked to local network's DNS servers while on VPN. This is due to a lack of protection for service data. An attacker could exploit this to gain unauthorized access to information.

Recommendations: For GNOME NetworkManager version 1.10.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-1167

BDU:2020-01815

CVE-2018-1000135

OPENSUSE-SU-2019:1494-1

OPENSUSE-SU-2019_1494-1

OPENSUSE-SU-2024:10602-1

SUSE-SU-2019:1369-1

SUSE-SU-2019_1369-1

Affected Products

Alt Linux

Networkmanager-Gnome

Suse

References · 36

• https://cve.org/CVERecord?id=CVE-2018-1000135 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1000135 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1494-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000135 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00005.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000135 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-1167 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000135 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000135 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000135 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10602-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01815 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:1369-1 · Vendor Advisory