PT-2017-10734 · Gnome+2 · Shotwell+2

Jens Georg · Published 2017-07-13 · Updated 2019-10-03 · CVE-2017-1000024

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shotwell versions 0.24.4 or earlier Shotwell versions 0.25.3 or earlier

Description The issue concerns an information disclosure in the web publishing plugins of Shotwell, potentially resulting in the plaintext transmission of passwords and oauth tokens.

Recommendations For Shotwell versions 0.24.4 or earlier, update to a version later than 0.24.4 to resolve the issue. For Shotwell versions 0.25.3 or earlier, update to a version later than 0.25.3 to resolve the issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2017-1000024

MGASA-2017-0480

SUSE-SU-2018:0637-1

SUSE-SU-2018_0637-1

USN-3379-1

Affected Products

Shotwell

Suse

Ubuntu

References · 22

• https://cve.org/CVERecord?id=CVE-2017-1000024 · Security Note
• https://ubuntu.com/security/CVE-2017-1000024 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-1000024 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3379-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000024 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000024 · Vendor Advisory
• https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000024 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:0637-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000024 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0480 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0480.html · Security Note
• https://osv.dev/vulnerability/USN-3379-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000024 · Vendor Advisory
• https://bugzilla.suse.com/1054311 · Note