CVE-2018-20781

HIGH

Gnome Keyring < 3.27.2 - Insufficiently Protected Credentials

Title source: rule

Description

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

References (8)

Scores

CVSS v3 7.8
EPSS 0.0425
EPSS Percentile 88.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-522
Status published

Affected Products (4)

gnome/gnome_keyring < 3.27.2
canonical/ubuntu_linux
canonical/ubuntu_linux
oracle/zfs_storage_appliance_kit

Timeline

Published Feb 12, 2019
Tracked Since Feb 18, 2026