CVE-2020-17489

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-08-11 · updated 2026-06-17
Weakness: CWE-522

Description

An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. (If the password were never shown in cleartext, only the password length is revealed.)

Affected products

Canonical Ubuntu Linux: 20.04
Debian Linux: 9.0
gnome-shell: through 3.36.4
openSUSE Leap: 15.2

References

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00028.html
https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/2997
https://lists.debian.org/debian-lts-announce/2020/09/msg00014.html
https://security.gentoo.org/glsa/202009-08
https://usn.ubuntu.com/4464-1/
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00028.html
https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/2997
https://lists.debian.org/debian-lts-announce/2020/09/msg00014.html
https://security.gentoo.org/glsa/202009-08
https://usn.ubuntu.com/4464-1/

Get alerted when CVE-2020-17489 or the next vulnerability affects your stack