Insufficiently protected credentials in gnome-shell - CVE-2020-17489

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU48557

Insufficiently protected credentials in gnome-shell - CVE-2020-17489

Published: August 11, 2020 / Updated: November 19, 2020


Vulnerability identifier: #VU48557
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-17489
CWE-ID: CWE-522
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the way GNOME gnome-shell handles the password box after user logout. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. An attacker with physical access to the system can eavesdrop on the password.


Affected software

gnome-shell
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
openEuler
Ubuntu
gnome-shell (Red Hat package)
gnome-shell (Alpine package)
gnome-shell
gnome-shell-debuginfo
gnome-shell-debugsource
gnome-shell-help
gnome-base/gnome-shell
gnome-shell (Ubuntu package)

How to mitigate CVE-2020-17489

Install updates from vendor's website.

gnome-shell - update to 3.36.5
gnome-shell (Red Hat package) - update to 3.32.2-44.el8
gnome-shell (Alpine package) - update to 3.36.5-r0
gnome-shell - update to 3.30.1-8
gnome-shell-debuginfo - update to 3.30.1-8
gnome-shell-debugsource - update to 3.30.1-8
gnome-shell-help - update to 3.30.1-8
gnome-shell - update to 3.32.2-44.0.1
gnome-base/gnome-shell - update to 3.34.5-r1
gnome-shell (Ubuntu package) - update to 3.36.4-1ubuntu1~20.04.2

External References

Related Security Bulletins