CVE-2018-20839

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-20839
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.securityfocus.com/bid/108389 Broken Link Third Party Advisory VDB Entry
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993 Issue Tracking Third Party Advisory
https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f Patch
https://github.com/systemd/systemd/pull/12378 Issue Tracking Patch
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E Mailing List
https://security.netapp.com/advisory/ntap-20190530-0002/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:systemd_project:systemd:242:-:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
History

24 Oct 2024, 17:34

Type Values Removed Values Added
CVSS v2 : 4.3
v3 : 9.8 		v2 : 4.3
v3 : 4.3
CWE CWE-200 NVD-CWE-noinfo
References () http://www.securityfocus.com/bid/108389 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/108389 - Broken Link, Third Party Advisory, VDB Entry
References () https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f - Patch, Third Party Advisory () https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f - Patch
References () https://github.com/systemd/systemd/pull/12378 - Third Party Advisory () https://github.com/systemd/systemd/pull/12378 - Issue Tracking, Patch
References () https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - () https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - Mailing List
References () https://security.netapp.com/advisory/ntap-20190530-0002/ - Patch, Third Party Advisory () https://security.netapp.com/advisory/ntap-20190530-0002/ - Third Party Advisory

20 Feb 2022, 06:10

Type Values Removed Values Added
CVSS v2 : 5.0
v3 : 9.8 		v2 : 4.3
v3 : 9.8
CPE cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*
References (MLIST) https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E - (MLIST) https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E - Mailing List, Third Party Advisory
References (BID) http://www.securityfocus.com/bid/108389 - (BID) http://www.securityfocus.com/bid/108389 - Third Party Advisory, VDB Entry
References (CONFIRM) https://security.netapp.com/advisory/ntap-20190530-0002/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20190530-0002/ - Patch, Third Party Advisory

28 Jan 2022, 19:12

Type Values Removed Values Added
CPE cpe:2.3:a:freedesktop:systemd:242:-:*:*:*:*:*:* cpe:2.3:a:systemd_project:systemd:242:-:*:*:*:*:*:*
Information

Published : 2019-05-17 04:29

Updated : 2024-10-24 17:34

NVD link : CVE-2018-20839

Mitre link : CVE-2018-20839

CVE.ORG link : CVE-2018-20839

JSON object : View

Products Affected

netapp

  • solidfire_\&_hci_management_node
  • snapprotect
  • cn1610
  • cn1610_firmware

systemd_project

  • systemd
CWE
NVD-CWE-noinfo