UBUNTU-CVE-2018-1000135

Advisory lineage Upstream: 1 Downstream: 0
Published: 20 Mar 2018, 13:29
Last modified:22 Apr 2026, 11:39

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
3.0 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Mar 2018, 13:29
Published
Vulnerability first disclosed
22 Apr 2026, 11:39
Last Modified
Vulnerability information updated

Description

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

CVSS Metrics

  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Systems

  • ubuntu•network-manager

    all | < 1.10.6-2ubuntu1.2

References (2)