SB2022051143 - Red Hat Enterprise Linux 8 update for gnome-shell
Published: May 11, 2022
Security Bulletin ID
SB2022051143
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Physical access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insufficiently protected credentials (CVE-ID: CVE-2020-17489)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the way GNOME gnome-shell handles the password box after user logout. When logging out of an account, the password box from the login dialog
reappears with the password still visible. If the user had decided to
have the password shown in cleartext at login time, it is then visible
for a brief moment upon a logout. An attacker with physical access to the system can eavesdrop on the password.
Remediation
Install update from vendor's website.