CVE-2018-20781
Fixed in a distro release EPSS 2%
In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.
Products: gnome-keyring, canonical ubuntu_linux, oracle zfs_storage_appliance_kit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | gnome-keyring | 3.27.2-1 |
| Debian 12 | gnome-keyring | 3.28.0-1 |
| Debian 13 | gnome-keyring | 3.28.0-1 |
| Debian 14 | gnome-keyring | 3.28.0-1 |
| Ubuntu 14.04 LTS | gnome-keyring | 3.10.1-1ubuntu4.4 |
| Ubuntu 16.04 LTS | gnome-keyring | 3.18.3-0ubuntu2.1 |