An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. (If the password were never shown in cleartext, only the password length is revealed.)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1814 advisory.

  - An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of     an account, the password box from the login dialog reappears with the password still visible. If the user     had decided to have the password shown in cleartext at login time, it is then visible for a brief moment     upon a logout. (If the password were never shown in cleartext, only the password length is revealed.)     (CVE-2020-17489)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:1814 advisory.

  - An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of     an account, the password box from the login dialog reappears with the password still visible. If the user     had decided to have the password shown in cleartext at login time, it is then visible for a brief moment     upon a logout. (If the password were never shown in cleartext, only the password length is revealed.)     (CVE-2020-17489)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:1814 advisory.

    GNOME Shell acts as a compositing manager for the desktop, and displays both application windows and other     objects. It provides core interface functions like switching windows, launching applications, and     notifications. It takes advantage of the capabilities of modern graphics hardware and introduces     innovative user interface concepts.

    Security Fix(es):

    * gnome-shell: Password from logged-out user may be shown on login screen (CVE-2020-17489)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:1814 advisory.

  - gnome-shell: Password from logged-out user may be shown on login screen (CVE-2020-17489)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for gnome-settings-daemon, gnome-shell fixes the following issues :

gnome-settings-daemon :

Add support for recent UCM related changes in ALSA and PulseAudio.
(jsc#SLE-16518)

Don't warn when a default source or sink is missing and the PulseAudio daemon is restarting. (jsc#SLE-16518)

Don't warn about starting/stopping services which don't exist.
(bsc#1172760).

gnome-shell :

Add support for recent UCM related changes in ALSA and PulseAudio.
(jsc#SLE-16518)

CVE-2020-17489: reset auth prompt on vt switch before fade in in loginDialog (bsc#1175155).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gnome-settings-daemon, gnome-shell fixes the following issues :

gnome-settings-daemon :

  - Add support for recent UCM related changes in ALSA and     PulseAudio. (jsc#SLE-16518)

  - Don't warn when a default source or sink is missing and     the PulseAudio daemon is restarting. (jsc#SLE-16518)

  - Don't warn about starting/stopping services which don't     exist. (bsc#1172760).

gnome-shell :

  - Add support for recent UCM related changes in ALSA and     PulseAudio. (jsc#SLE-16518)

  - CVE-2020-17489: reset auth prompt on vt switch before     fade in in loginDialog (bsc#1175155).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

It was discovered that there was an issue around revealing passwords in the 'gnome-shell' component of the GNOME desktop.

In certain configurations, when logging out of an account the password box from the login dialog could reappear with the password visible in cleartext.

For Debian 9 'Stretch', this problem has been fixed in version 3.22.3-3+deb9u1.

We recommend that you upgrade your gnome-shell packages.

For the detailed security status of gnome-shell please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/gnome-shell

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202009-08 (GNOME Shell: Information disclosure)

    It was discovered that GNOME Shell incorrectly handled the login screen       password dialog.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4464-1 advisory.

    It was discovered that GNOME Shell incorrectly handled the login screen password dialog. Sensitive     information could possibly be exposed during user logout.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185081	Rocky Linux 8 : gnome-shell (RLSA-2022:1814)	Nessus	Rocky Linux Local Security Checks	medium
161104	AlmaLinux 8 : gnome-shell (ALSA-2022:1814)	Nessus	Alma Linux Local Security Checks	medium
161017	RHEL 8 : gnome-shell (RHSA-2022:1814)	Nessus	Red Hat Local Security Checks	medium
160914	CentOS 8 : gnome-shell (CESA-2022:1814)	Nessus	CentOS Local Security Checks	medium
143644	SUSE SLED15 / SLES15 Security Update : gnome-settings-daemon, gnome-shell (SUSE-SU-2020:3132-1)	Nessus	SuSE Local Security Checks	medium
142628	openSUSE Security Update : gnome-settings-daemon / gnome-shell (openSUSE-2020-1861)	Nessus	SuSE Local Security Checks	medium
140606	Debian DLA-2374-1 : gnome-shell security update	Nessus	Debian Local Security Checks	medium
140563	GLSA-202009-08 : GNOME Shell: Information disclosure	Nessus	Gentoo Local Security Checks	medium
139692	Ubuntu 20.04 LTS : GNOME Shell vulnerability (USN-4464-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2020-17489

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium