CVE-2023-5616 | ByteOS Network

Vulnerability Details :

CVE-2023-5616

Assigner-canonical

Assigner Org ID-cc1ad9ee-3454-478d-9317-d3e869d708bc

Published At-15 Apr, 2025 | 18:29

Updated At-15 Apr, 2025 | 20:51

In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:canonical

Assigner Org ID:cc1ad9ee-3454-478d-9317-d3e869d708bc

Published At:15 Apr, 2025 | 18:29

Updated At:15 Apr, 2025 | 20:51

▼CVE Numbering Authority (CNA)

In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.

Affected Products

Vendor

Product

Ubuntu's gnome-control-center

Package Name

Ubuntu's gnome-control-center

Repo

https://git.launchpad.net/ubuntu/+source/gnome-remote-desktop

Platforms

Linux

Versions

Affected

From 1:45 before 1:45.0-1ubuntu3.1 (deb)
From 1:44 before 1:44.0-1ubuntu6.1 (deb)
From 1:41 before 1:41.7-0ubuntu0.22.04.8 (deb)
From 1:3 before 1:3.36.5-0ubuntu4.1 (deb)

Credits

finder

Zygmunt Krynicki

References

Hyperlink	Resource
https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/2039577	issue-tracking
https://ubuntu.com/security/notices/USN-6554-1	vendor-advisory
https://ubuntu.com/security/CVE-2023-5616	issue-tracking

Hyperlink: https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/2039577

Resource:

issue-tracking

Hyperlink: https://ubuntu.com/security/notices/USN-6554-1

Resource:

vendor-advisory

Hyperlink: https://ubuntu.com/security/CVE-2023-5616

Resource:

issue-tracking

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-290	CWE-290 Authentication Bypass by Spoofing

Type: CWE

CWE ID: CWE-290

Description: CWE-290 Authentication Bypass by Spoofing

Metrics

Version	Base score	Base severity	Vector
3.1	4.9	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Version: 3.1

Base score: 4.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security@ubuntu.com

Published At:15 Apr, 2025 | 19:16

Updated At:26 Aug, 2025 | 16:34

In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.9	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 4.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CPE Matches

The GNOME Project

>>control_center>>Versions from 1.3(inclusive) to 1.3.36.5-0ubuntu4.1(exclusive)

cpe:2.3:a:gnome:control_center:*:*:*:*:*:*:*:*

The GNOME Project

>>control_center>>Versions from 1.41(inclusive) to 1.41.7-0ubuntu0.22.04.8(exclusive)

cpe:2.3:a:gnome:control_center:*:*:*:*:*:*:*:*

The GNOME Project

>>control_center>>Versions from 1.44(inclusive) to 1.44.0-1ubuntu6.1(exclusive)

cpe:2.3:a:gnome:control_center:*:*:*:*:*:*:*:*

The GNOME Project

>>control_center>>Versions from 1.45(inclusive) to 1.45.0-1ubuntu3.1(exclusive)

cpe:2.3:a:gnome:control_center:*:*:*:*:*:*:*:*

>>ubuntu_linux>>20.04

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

>>ubuntu_linux>>22.04

cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*

>>ubuntu_linux>>23.04

cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*

>>ubuntu_linux>>23.10

cpe:2.3:o:canonical:ubuntu_linux:23.10:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-290	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-290

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/2039577	security@ubuntu.com	Exploit Issue Tracking
https://ubuntu.com/security/CVE-2023-5616	security@ubuntu.com	Vendor Advisory
https://ubuntu.com/security/notices/USN-6554-1	security@ubuntu.com	Vendor Advisory

Hyperlink: https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/2039577

Source: security@ubuntu.com

Resource:

Exploit

Issue Tracking

Hyperlink: https://ubuntu.com/security/CVE-2023-5616

Source: security@ubuntu.com

Resource:

Vendor Advisory

Hyperlink: https://ubuntu.com/security/notices/USN-6554-1

Source: security@ubuntu.com

Resource:

Vendor Advisory

Similar CVEs

3Records found

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.24% / 47.32%

||

7 Day CHG~0.00%

Published-16 Feb, 2018 | 17:00

Updated-05 Aug, 2024 | 21:13

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).

Vendor-n/a Canonical Ltd.Debian GNU/Linux Apple Inc.

Product-ubuntu_linux cups debian_linux n/a

CWE ID-CWE-290

Authentication Bypass by Spoofing

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.51% / 65.32%

||

7 Day CHG~0.00%

Published-17 Sep, 2019 | 11:24

Updated-05 Aug, 2024 | 01:17

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.

Vendor-trusteddomain n/a Canonical Ltd.Fedora Project Debian GNU/Linux

Product-ubuntu_linux debian_linux fedora opendmarc n/a

CWE ID-CWE-290

Authentication Bypass by Spoofing

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.2||MEDIUM

EPSS-0.10% / 28.49%

||

7 Day CHG~0.00%

Published-07 May, 2024 | 00:00

Updated-18 Jun, 2025 | 14:36

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.

Vendor-n/a Fedora Project Debian GNU/Linux NetApp, Inc.The GNOME Project

Product-ontap_tools glib debian_linux fedora n/a

CWE ID-CWE-290

Authentication Bypass by Spoofing