GNOME NetworkManager version 1.10.6 and earlier, when used with dns dnsmasq plugin, contains a information exposure vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in some Ubuntu 16.04 packages, but later updates removed the fix. References: https://bugs.launchpad.net/ubuntu/+bug/1754671 https://bugzilla.redhat.com/show_bug.cgi?id=1553634
Created NetworkManager tracking bugs for this issue: Affects: fedora-all [bug 1558608]
Ongoing effort to create a patch: https://bugzilla.gnome.org/show_bug.cgi?id=746422
Mitigation: We suggest to keep the default `dns=default` in the NetworkManager configuration file to prevent DNS queries leaks to possibly hostile DNS servers.
On RHEL 7 and Fedora, `dns=default` is used by default, which is not vulnerable to this problem, since it does not use "split DNS".
Statement: This issue did not affect the versions of NetworkManager as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for dnsmasq DNS resolver.
(In reply to Riccardo Schirone from comment #7) > On RHEL 7 and Fedora, `dns=default` is used by default, which is not > vulnerable to this problem, since it does not use "split DNS". Please note discussion in https://bugzilla.redhat.com/show_bug.cgi?id=1863041 Let's make sure we don't introduce this vulnerability in Fedora as we enable split DNS via systemd-resolved. VPNs by default should use the VPN DNS for *all* lookups unless explicitly configured otherwise.