CVE-2018-17780 Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connectio...
MediumCVSS 6.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/telegram-desktop(Ubuntu:22.04) | All versions | No fix listed |
| debian/telegram-desktop(Debian:12) | < 1.4.0-1 | 1.4.0-1 |
| debian/telegram-desktop(Debian:14) | < 1.4.0-1 | 1.4.0-1 |
| debian/telegram-desktop(Debian:14) | = 1.0.14-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.0.29-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.0-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.10-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.18-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.19-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.19-2 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.23-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.23-1~bpo9+1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.23-2 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.1.23-3 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.2.1-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.2.1-2 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.2.15-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.2.17-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.2.6-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.2.6-2 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.3.10-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.3.10-2 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.3.14-1 | No fix listed |
| debian/telegram-desktop(Debian:14) | = 1.3.7-1 | No fix listed |
| Telegram Desktop | = 1.3.14 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| telegram messenger | = 3.3.0.0 | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-17780 vendor-advisory
- 105521 third-party-advisory vdb-entry
- www.inputzero.io exploit third-party-advisory