ByteOS Network

NVD Vulnerability Details :

CVE-2018-20781

Analyzed

Source-cve@mitre.org

Published At-12 Feb, 2019 | 17:29

Updated At-16 Mar, 2021 | 14:02

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

The GNOME Project

>>gnome_keyring>>Versions before 3.27.2(exclusive)

cpe:2.3:a:gnome:gnome_keyring:*:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>14.04

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

Canonical Ltd.

>>ubuntu_linux>>16.04

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Oracle Corporation

>>zfs_storage_appliance_kit>>8.8

cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-522	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919	cve@mitre.org	Issue Tracking Patch Third Party Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=781486	cve@mitre.org	Issue Tracking Patch Vendor Advisory
https://github.com/huntergregal/mimipenguin	cve@mitre.org	Third Party Advisory
https://github.com/huntergregal/mimipenguin/tree/d95f1e08ce79783794f38433bbf7de5abd9792da	cve@mitre.org	Third Party Advisory
https://gitlab.gnome.org/GNOME/gnome-keyring/issues/3	cve@mitre.org	Vendor Advisory
https://gitlab.gnome.org/GNOME/gnome-keyring/tags/3.27.2	cve@mitre.org	Release Notes Vendor Advisory
https://usn.ubuntu.com/3894-1/	cve@mitre.org	Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html	cve@mitre.org	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History