CVE-2019-3825
First published: Wed Feb 06 2019(Updated: )
A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gnome Gnome Display Manager | <3.31.4 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =18.10 | |
| Redhat Enterprise Linux | =7.0 | |
| ubuntu/gdm3 | <3.28.3-0ubuntu18.04.4 | 3.28.3-0ubuntu18.04.4 |
| ubuntu/gdm3 | <3.30.1-1ubuntu5.1 | 3.30.1-1ubuntu5.1 |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| ubuntu/gdm3 | <3.31.4+ | 3.31.4+ |
| debian/gdm3 | 3.38.2.1-1 43.0-3 46.2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825
- https://usn.ubuntu.com/3892-1/
- https://launchpad.net/bugs/cve/CVE-2019-3825
- https://gitlab.gnome.org/GNOME/gdm/issues/460
- https://security-tracker.debian.org/tracker/CVE-2019-3825
- https://ubuntu.com/security/notices/USN-3892-1
- https://www.cve.org/CVERecord?id=CVE-2019-3825
- https://nvd.nist.gov/vuln/detail/CVE-2019-3825
- https://gitlab.gnome.org/GNOME/gdm/commit/7726c81db92d2339fc468ed41c967f5412db66ed
- https://gitlab.gnome.org/GNOME/gdm/commit/d9d22a1c48a528873e3cc84a73fc868507b8dd4d
- https://gitlab.gnome.org/GNOME/gdm/commit/94d9fec87960e3ff5f7b75dadcde2807db148fbd
- https://gitlab.gnome.org/GNOME/gdm/commit/dd45295425c5a843c30aa8797b02d59ff488acb8
- https://ubuntu.com/security/CVE-2019-3825
Frequently Asked Questions
What is CVE-2019-3825?
CVE-2019-3825 is a vulnerability in gdm before version 3.31.4 which allows an attacker to bypass the lock screen by exploiting timed login.
How severe is CVE-2019-3825?
CVE-2019-3825 is rated as medium severity with a CVSS score of 6.4.
Which software versions are affected by CVE-2019-3825?
The affected software versions include gdm3 3.30.2-3, 3.38.2.1-1, 43.0-3, 45.0.1-1, and some versions of gdm3 for Ubuntu.
How can I fix CVE-2019-3825?
To fix CVE-2019-3825, update gdm3 to version 3.31.4 or higher.
Where can I find more information about CVE-2019-3825?
You can find more information about CVE-2019-3825 in the references provided: [Link 1](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825), [Link 2](https://usn.ubuntu.com/3892-1/), [Link 3](https://launchpad.net/bugs/cve/CVE-2019-3825).
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/event
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- agent/softwarecombine
- collector/security-tracker-debian
- source/Debian
- vendor/gnome
- canonical/gnome gnome display manager
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/18.10
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- package-manager/ubuntu
- package-manager/debian