Critical Vulnerability in GDM and Related Packages: Security Update Required
Summary
RHSA-2019:2079: Red Hat Security Advisory: Xorg security and bug fix update. Affects gdm versions < 1:3.28.2-16.el7. Fixed in 1:3.28.2-16.el7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GDM (GNOME Display Manager) is a crucial component in the GNOME desktop environment, responsible for managing user sessions and providing a graphical login interface. It is widely used in various Linux distributions, including Red Hat Enterprise Linux. The recent security advisory highlights vulnerabilities that could potentially allow unauthorized access or compromise system integrity.
Vulnerability Detail
The vulnerabilities identified in GDM and its associated packages stem from multiple CVEs, including CVE-2018-14598 and CVE-2018-15864. These vulnerabilities can lead to unauthorized access, privilege escalation, and potential system crashes. The issues arise from improper input validation and insufficient security measures, making the system susceptible to attacks that exploit these weaknesses. The CVSS score for this vulnerability is 8.1, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
1:3.28.2-16.el7
This is the first release that contains the fix.
sudo dnf update gdmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the GDM service to prevent unauthorized access until the system is updated. This can be done using the following command:
sudo systemctl stop gdm
sudo systemctl disable gdm
However, this is not a permanent solution and should only be used until the vulnerability is patched.
Conclusion
The identified vulnerabilities in GDM and related packages pose significant risks to system security. It is crucial to apply the necessary updates as soon as possible to mitigate these risks and ensure the integrity of the system. Users are encouraged to utilize tools like Vulert to monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for gdm →
FAQ
GDM stands for GNOME Display Manager, which is responsible for managing user sessions and providing a graphical login interface in the GNOME desktop environment.
The vulnerabilities can lead to unauthorized access, privilege escalation, and potential system crashes, compromising the integrity of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider disabling the GDM service temporarily to mitigate risks until the system can be patched.
The CVSS score for this vulnerability is 8.1, indicating a high severity level that requires urgent attention.
Related vulnerabilities
Recent vulnerabilities recorded for gdm.
