| Summary: | gdm new security issue CVE-2020-16125 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | andrewsfarm, ouaurelien, sysadmin-bugs |
| Version: | 7 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7-64-OK | ||
| Source RPM: | gdm-3.38.1-1.mga8.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2020-11-06 00:23:45 CET
David Walser
2020-11-06 00:23:52 CET
Whiteboard:
(none) =>
MGA7TOO Ubuntu has issued an advisory for this on November 3: https://ubuntu.com/security/notices/USN-4614-1 Severity:
normal =>
major SUSE has issued an advisory for this today (November 16): https://lists.suse.com/pipermail/sle-security-updates/2020-November/007777.html openSUSE has issued an advisory for this on November 19: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZX3UTGQD6BVLNXN2RQDQJAGIEKRWA7A4/ Fix is present in the current version in Cauldron (3.38.2.1). Version:
Cauldron =>
7 Patched package uploaded for Mageia 7. Advisory: ======================== Updated gdm packages fix security vulnerability: Kevin Backhouse discovered that GDM incorrectly launched the initial setup tool when the accountsservice daemon was not reachable. A local attacker able to cause accountsservice to crash or stop responding could trick GDM into launching the initial setup tool and create a privileged user (CVE-2020-16125). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16125 https://ubuntu.com/security/notices/USN-4614-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZX3UTGQD6BVLNXN2RQDQJAGIEKRWA7A4/ ======================== Updated packages in core/updates_testing: ======================== gdm-3.32.0-1.1.mga7 libgdm1-3.32.0-1.1.mga7 libgdm-gir1.0-3.32.0-1.1.mga7 libgdm-devel-3.32.0-1.1.mga7 from gdm-3.32.0-1.1.mga7.src.rpm Assignee:
gnome =>
qa-bugs I was going to try installing this on a real hardware Plasma system, but it required installing a long list of Gnome-related dependencies that I didn't want, even on a testing system. So... I created a basic Gnome guest inside VirtualBox. Once that was established, I installed QARepo and used it to get the updates for gdm. No installation issues. Did a reboot, and no issues were obvious to this non-Gnome user. I believe this is sufficient as a test for this update, so I am OKing and validating. Advisory in Comment 5. Keywords:
(none) =>
validated_update Advisory pushed to SVN. CC:
(none) =>
ouaurelien An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0003.html Status:
NEW =>
RESOLVED |