PT-2017-10734 · Gnome+2 · Shotwell+2

Jens Georg · Publicado 2017-07-13 · Atualizado 2019-10-03 · CVE-2017-1000024

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shotwell versions 0.24.4 or earlier Shotwell versions 0.25.3 or earlier

Description The issue concerns an information disclosure in the web publishing plugins of Shotwell, potentially resulting in the plaintext transmission of passwords and oauth tokens.

Recommendations For Shotwell versions 0.24.4 or earlier, update to a version later than 0.24.4 to resolve the issue. For Shotwell versions 0.25.3 or earlier, update to a version later than 0.25.3 to resolve the issue.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2017-1000024

MGASA-2017-0480

SUSE-SU-2018:0637-1

SUSE-SU-2018_0637-1

USN-3379-1

Produtos afetados

Shotwell

Suse

Ubuntu

Referências · 22

• https://cve.org/CVERecord?id=CVE-2017-1000024 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-1000024 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-1000024 · Aviso do Fabricante
• https://bugzilla.suse.com/1054311 · Nota
• https://ubuntu.com/security/notices/USN-3379-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000024 · Nota de Segurança
• https://lists.suse.com/pipermail/sle-security-updates/2018-March/003794.html · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000024 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=21478 · Nota
• https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-1000024.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000024 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-1000024 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2018:0637-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000024 · Aviso do Fabricante