CVE-2018-20781

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-12 · updated 2026-06-17
Weakness: CWE-522

Description

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04
Gnome Keyring: before 3.27.2 — fixed in 3.27.2
Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8

How to fix

Upgrade to a fixed version: Gnome Keyring 3.27.2. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919
https://bugzilla.gnome.org/show_bug.cgi?id=781486
https://github.com/huntergregal/mimipenguin
https://github.com/huntergregal/mimipenguin/tree/d95f1e08ce79783794f38433bbf7de5abd9792da
https://gitlab.gnome.org/GNOME/gnome-keyring/issues/3
https://gitlab.gnome.org/GNOME/gnome-keyring/tags/3.27.2
https://usn.ubuntu.com/3894-1/
https://www.oracle.com/security-alerts/cpujan2021.html
https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919
https://bugzilla.gnome.org/show_bug.cgi?id=781486
https://github.com/huntergregal/mimipenguin
https://github.com/huntergregal/mimipenguin/tree/d95f1e08ce79783794f38433bbf7de5abd9792da

Get alerted when CVE-2018-20781 or the next vulnerability affects your stack