Critical Vulnerability in gdm and gnome-session Packages: Security Advisory RHSA-2017:2128
Summary
RHSA-2017:2128: Red Hat Security Advisory: gdm and gnome-session security, bug fix, and enhancement update. Affects gdm versions < 1:3.22.3-11.el7. Fixed in 1:3.22.3-11.el7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gdm (GNOME Display Manager) and gnome-session packages are essential components of the GNOME desktop environment, providing graphical login capabilities and session management for users. These packages facilitate user authentication and session initiation, ensuring a seamless user experience in Linux environments. However, vulnerabilities in these packages can expose systems to security risks, making it crucial to maintain updated versions.
Vulnerability Detail
The vulnerability identified in the gdm and gnome-session packages is linked to CVE-2015-7496. This issue arises from improper handling of user input, which could allow an attacker to exploit the system by gaining unauthorized access or executing arbitrary code. The potential ramifications include unauthorized access to user sessions, data breaches, and system compromise. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level that necessitates prompt attention.
How To Fix
Minimum fixed version
1:3.22.3-11.el7
This is the first release that contains the fix.
sudo dnf update gdmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the gdm service until the packages are updated. This can be done by executing the following command:
sudo systemctl stop gdm.service
However, this is not a long-term solution and should only be used until the packages are patched.
Conclusion
The vulnerability in the gdm and gnome-session packages poses a significant risk to users of the GNOME desktop environment. It is crucial to update these packages to their patched versions to mitigate potential security threats. Users should also consider utilizing tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for gdm →
FAQ
CVE-2015-7496 is a security vulnerability affecting the gdm and gnome-session packages that could allow unauthorized access or execution of arbitrary code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling the gdm service as a temporary workaround until the packages can be updated.
Failing to address this vulnerability could lead to unauthorized access to user sessions, data breaches, and overall system compromise.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for gdm.
