Vulnerability in gdm package - DisallowTCP option not being used
Summary
ALBA-2022:1564: gdm bug fix and enhancement update. Affects gdm versions < 1:40.0-15.el8_5.3. Fixed in 1:40.0-15.el8_5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The GNOME Display Manager (GDM) is responsible for providing the graphical login screen in the AlmaLinux 8 operating system. This screen is displayed shortly after boot, after logging out, and when switching between users. It plays a crucial role in facilitating user authentication and session management.
Vulnerability Detail
The vulnerability identified in the gdm package is related to the incorrect usage of the "DisallowTCP=false" option in the /etc/gdm/custom.conf file. This option is intended to allow or disallow TCP connections for GDM. However, due to a bug, the option is not being utilized as expected. This issue can have security implications as it may allow unauthorized access to the GDM service via TCP connections, potentially leading to unauthorized system access or information disclosure.
How To Fix
Minimum fixed version
1:40.0-15.el8_5.3
This is the first release that contains the fix.
sudo dnf update gdmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually modify the /etc/gdm/custom.conf file to set the "DisallowTCP" option to "true". This can be achieved by opening the file in a text editor and changing the line "DisallowTCP=false" to "DisallowTCP=true". After making this change, the GDM service should be restarted for the new configuration to take effect.
Conclusion
In conclusion, the gdm package in AlmaLinux 8 is affected by a vulnerability where the "DisallowTCP=false" option is not being used as intended. This can potentially allow unauthorized access to the GDM service via TCP connections. It is recommended to update the gdm package to version 1:40.0-15.el8_5.3 or later to fix this vulnerability. A temporary workaround is available by manually modifying the /etc/gdm/custom.conf file. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gdm →
FAQ
This vulnerability can potentially allow unauthorized access to the GDM service via TCP connections, which may lead to unauthorized system access or information disclosure.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. It is recommended to update the gdm package to version 1:40.0-15.el8_5.3 or later to address this issue.
Yes, a temporary workaround is available. You can manually modify the /etc/gdm/custom.conf file and set the "DisallowTCP" option to "true". However, it is still recommended to apply the official fix by updating the gdm package.
You can find more information about this vulnerability in the AlmaLinux 8 advisory ALBA-2022:1564 at https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALBA-2022:1564.json.
Related vulnerabilities
Recent vulnerabilities recorded for gdm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
