SB2020081156 - Information disclosure in GNOME gnome-shell

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020081156

SB2020081156 - Information disclosure in GNOME gnome-shell

Published: August 11, 2020 Updated: November 19, 2020

Security Bulletin ID SB2020081156
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Physical access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Insufficiently protected credentials (CVE-ID: CVE-2020-17489)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the way GNOME gnome-shell handles the password box after user logout. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. An attacker with physical access to the system can eavesdrop on the password.


Remediation

Install update from vendor's website.

References