GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

According to the version of the NetworkManager packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - An information exposure vulnerability has been found in     NetworkManager when dnsmasq is used in DNS processing     mode. An attacker in control of a DNS server could     receive DNS queries even though a Virtual Private     Network (VPN) was configured on the vulnerable     machine.(CVE-2018-1000135)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the NetworkManager package has been released.

According to the version of the NetworkManager packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An information exposure vulnerability has been found in     NetworkManager when dnsmasq is used in DNS processing     mode. An attacker in control of a DNS server could     receive DNS queries even though a Virtual Private     Network (VPN) was configured on the vulnerable     machine.(CVE-2018-1000135)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the NetworkManager packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - GNOME NetworkManager version 1.10.2 and earlier     contains a Information Exposure (CWE-200) vulnerability     in DNS resolver that can result in Private DNS queries     leaked to local network's DNS servers, while on VPN.
    This vulnerability appears to have been fixed in Some     Ubuntu 16.04 packages were fixed, but later updates     removed the fix. cf.
    https://bugs.launchpad.net/ubuntu/+bug/1754671 an     upstream fix does not appear to be available at this     time.(CVE-2018-1000135)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for NetworkManager fixes the following issues :

Following security issue was fixed :

  - CVE-2018-1000135: A potential leak of private DNS     queries to other DNS servers could happen while on VPN     (bsc#1086263, bgo#746422).

This update was imported from the SUSE:SLE-15:Update update project.

This update for NetworkManager fixes the following issues :

Following security issue was fixed :

CVE-2018-1000135: A potential leak of private DNS queries to other DNS servers could happen while on VPN (bsc#1086263, bgo#746422).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
137941	EulerOS Virtualization 3.0.6.0 : NetworkManager (EulerOS-SA-2020-1722)	Nessus	Huawei Local Security Checks	high
136405	Photon OS 1.0: Networkmanager PHSA-2020-1.0-0291	Nessus	PhotonOS Local Security Checks	high
136227	EulerOS Virtualization for ARM 64 3.0.2.0 : NetworkManager (EulerOS-SA-2020-1524)	Nessus	Huawei Local Security Checks	high
132365	EulerOS 2.0 SP5 : NetworkManager (EulerOS-SA-2019-2698)	Nessus	Huawei Local Security Checks	high
132171	EulerOS 2.0 SP3 : NetworkManager (EulerOS-SA-2019-2636)	Nessus	Huawei Local Security Checks	high
131863	EulerOS 2.0 SP2 : NetworkManager (EulerOS-SA-2019-2371)	Nessus	Huawei Local Security Checks	high
125694	openSUSE Security Update : NetworkManager (openSUSE-2019-1494)	Nessus	SuSE Local Security Checks	high
125539	SUSE SLED15 / SLES15 Security Update : NetworkManager (SUSE-SU-2019:1369-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-1000135

high

Tenable Plugins

high

high

high

high

high

high

high

high