CVE-2018-19358: High severity gnome keyring vulnerability
GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19358?
CVE-2018-19358 has a moderate severity level due to the potential for unauthorized access to sensitive login credentials.
How do I fix CVE-2018-19358?
To fix CVE-2018-19358, update GNOME Keyring to version 3.28.3 or later where the vulnerability is addressed.
Who is affected by CVE-2018-19358?
CVE-2018-19358 affects local users of GNOME Keyring versions up to 3.28.2 who have the keyring unlocked.
Can CVE-2018-19358 be exploited remotely?
CVE-2018-19358 cannot be exploited remotely as it requires local access to the vulnerable system.
What are the impacts of CVE-2018-19358?
The impacts of CVE-2018-19358 include the possibility of leaking sensitive credentials stored in the GNOME Keyring.