Debian-LTS has issued an advisory today (November 5): https://www.debian.org/lts/security/2020/dla-2434 Mageia 7 is also affected.
Whiteboard: (none) => MGA7TOO
Ubuntu has issued an advisory for this on November 3: https://ubuntu.com/security/notices/USN-4614-1
Severity: normal => major
SUSE has issued an advisory for this today (November 16): https://lists.suse.com/pipermail/sle-security-updates/2020-November/007777.html
openSUSE has issued an advisory for this on November 19: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZX3UTGQD6BVLNXN2RQDQJAGIEKRWA7A4/
Fix is present in the current version in Cauldron (3.38.2.1).
Version: Cauldron => 7Whiteboard: MGA7TOO => (none)
Patched package uploaded for Mageia 7. Advisory: ======================== Updated gdm packages fix security vulnerability: Kevin Backhouse discovered that GDM incorrectly launched the initial setup tool when the accountsservice daemon was not reachable. A local attacker able to cause accountsservice to crash or stop responding could trick GDM into launching the initial setup tool and create a privileged user (CVE-2020-16125). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16125 https://ubuntu.com/security/notices/USN-4614-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZX3UTGQD6BVLNXN2RQDQJAGIEKRWA7A4/ ======================== Updated packages in core/updates_testing: ======================== gdm-3.32.0-1.1.mga7 libgdm1-3.32.0-1.1.mga7 libgdm-gir1.0-3.32.0-1.1.mga7 libgdm-devel-3.32.0-1.1.mga7 from gdm-3.32.0-1.1.mga7.src.rpm
Assignee: gnome => qa-bugs
I was going to try installing this on a real hardware Plasma system, but it required installing a long list of Gnome-related dependencies that I didn't want, even on a testing system. So... I created a basic Gnome guest inside VirtualBox. Once that was established, I installed QARepo and used it to get the updates for gdm. No installation issues. Did a reboot, and no issues were obvious to this non-Gnome user. I believe this is sufficient as a test for this update, so I am OKing and validating. Advisory in Comment 5.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugsWhiteboard: (none) => MGA7-64-OK
Advisory pushed to SVN.
CC: (none) => ouaurelienKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0003.html
Status: NEW => RESOLVEDResolution: (none) => FIXED