PT-2018-4017 · Gnome+1 · Gnome Seahorse+1

Published 2018-11-18 · Updated 2024-08-07 · CVE-2008-7320

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNOME Seahorse versions prior to 3.31

Description The issue allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. This behavior is considered a design decision by a software maintainer, which is disputed.

Recommendations For GNOME Seahorse versions prior to 3.31, consider locking the keyring when the workstation is unattended to prevent unauthorized access to plaintext passwords.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-7320

Affected Products

Debian

Gnome Seahorse

References · 14

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7320 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-7320 · Security Note
• https://ubuntu.com/security/CVE-2008-7320 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-7320 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2008-7320 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-7320 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-7320 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/seahorse · Vendor Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=551036 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2008-7320 · Security Note
• https://bountysource.com/issues/3849352-seahorse-shows-passwords-without-verification · Note
• https://packages.debian.org/src:seahorse · Note
• https://bugs.launchpad.net/ubuntu/+source/seahorse/+bug/189774/comments/13 · Note
• https://bugs.launchpad.net/ubuntu/+source/seahorse/+bug/189774 · Note