Every CVE Search/ Get API key

CVE-2018-1000135

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200)...

7.5 HighFix available

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

2.02%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Record
CVE-2018-1000135
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Record
CVE-2018-1000135
Updated
2026-11-02
EUVDEUVD-2018-1854 No score

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Record
EUVD-2018-1854
Updated
2026-11-03
GitHub AdvisoriesGHSA-q94f-chfh-pq22 7.5

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200)...

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Record
GHSA-q94f-chfh-pq22
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 7.5

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Record
CVE-2018-1000135
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-1000135 7.5

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Record
DEBIAN-CVE-2018-1000135
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVRHBA-2018:3207 4.8

Red Hat Bug Fix Advisory: NetworkManager bug fix and enhancement update

Record
RHBA-2018:3207
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-1000135 7.5

GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.

Record
UBUNTU-CVE-2018-1000135
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2019:1494-1 No score

Security update for NetworkManager

This update for NetworkManager fixes the following issues:

Following security issue was fixed:

  • CVE-2018-1000135: A potential leak of private DNS queries to other DNS servers could happen while on VPN (bsc#1086263, bgo#746422).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1494-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10602-1 No score

NetworkManager-1.32.10-2.1 on GA media

These are all security issues fixed in the NetworkManager-1.32.10-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10602-1
Updated
2026-11-02
OSVSUSE-SU-2019:1369-1 No score

Security update for NetworkManager

This update for NetworkManager fixes the following issues:

Following security issue was fixed:

  • CVE-2018-1000135: A potential leak of private DNS queries to other DNS servers could happen while on VPN (bsc#1086263, bgo#746422).
Record
SUSE-SU-2019:1369-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
network-manager
Debian:12
 before 1.12.0-2
1.12.0-2
network-manager
Debian:13
 before 1.12.0-2
1.12.0-2
network-manager
Debian:14
 before 1.12.0-2
1.12.0-2
NetworkManager
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-adsl
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-bluetooth
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-debuginfo
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-glib
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-libnm
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-ppp
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
Show 64 moreShow less
Affected packages
PackageAffectedFixed
NetworkManager-team
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-tui
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-wifi
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-wwan
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-config-server
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-dispatcher-routing-rules
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-glib-devel
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-libnm-devel
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-ovs
Red Hat:enterprise_linux:7::client
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-adsl
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-bluetooth
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-glib
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-libnm
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-ppp
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-team
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-tui
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-wifi
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-wwan
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-config-server
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-dispatcher-routing-rules
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-glib-devel
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-libnm-devel
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-ovs
Red Hat:enterprise_linux:7::computenode
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-adsl
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-bluetooth
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-config-server
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-debuginfo
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-glib
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-libnm
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-ppp
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-team
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-tui
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-wifi
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-wwan
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-dispatcher-routing-rules
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-glib-devel
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-libnm-devel
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-ovs
Red Hat:enterprise_linux:7::server
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-adsl
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-bluetooth
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-glib
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-libnm
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-ppp
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-team
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-tui
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-wifi
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-wwan
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-config-server
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-dispatcher-routing-rules
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-glib-devel
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-libnm-devel
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager-ovs
Red Hat:enterprise_linux:7::workstation
 before 1:1.12.0-6.el7
1:1.12.0-6.el7
NetworkManager
SUSE:Linux Enterprise Module for Basesystem 15
 before 1.10.6-5.6.1
1.10.6-5.6.1
NetworkManager
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 1.10.6-5.6.1
1.10.6-5.6.1
NetworkManager
SUSE:Linux Enterprise Workstation Extension 15
 before 1.10.6-5.6.1
1.10.6-5.6.1
network-manager
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.4-0ubuntu51.0.4-0ubuntu61.0.4-0ubuntu71.0.4-0ubuntu81.0.4-0ubuntu9
Show 12 moreShow less
1.0.4-0ubuntu101.1.93-0ubuntu21.1.93-0ubuntu31.1.93-0ubuntu41.2.0-0ubuntu0.16.04.21.2.0-0ubuntu0.16.04.31.2.2-0ubuntu0.16.04.11.2.2-0ubuntu0.16.04.31.2.2-0ubuntu0.16.04.41.2.6-0ubuntu0.16.04.11.2.6-0ubuntu0.16.04.21.2.6-0ubuntu0.16.04.3
 None known
network-manager
Ubuntu:18.04:LTS
 before 1.10.6-2ubuntu1.2, plus listed versions
1.8.4-1ubuntu31.8.4-1ubuntu41.10.4-1ubuntu21.10.4-1ubuntu31.10.6-2ubuntu11.10.6-2ubuntu1.1
1.10.6-2ubuntu1.2
NetworkManager
openSUSE:Leap 15.0
 before 1.10.6-lp150.4.6.1
1.10.6-lp150.4.6.1
NetworkManager
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 1.32.10-2.1
1.32.10-2.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1000135 is a high vulnerability (CVSS 7.5) in Gnome Networkmanager, published March 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.02%, the 81st percentile. Fixed in network-manager 1.12.0-2.

References

Show 49 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open