CVE-2018-20781

gnome-keyring: user's login credentials is kept in a session-child process resulting in exposed plaintext password

Loading…

Severity

Low

Red Hat Product Security

4.4

CVSS 3.0

Review impact separately from score.

Published · April 19, 2017

Updated · November 22, 2025

Description

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 4.4
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-522 · Insufficiently Protected Credentials