CVE-2018-19358: gnome gnome-keyring
Vulnerability summary
CVE-2018-19358 is a high (CVSS 7.8) vulnerability in gnome gnome-keyring. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.3% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 18-11-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used. NOTE: the vendor disputes this because, according to the security model, untrusted applications must not be allowed to access the user's session bus socket.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundKeyring Crack
Maturity: poc
Exploit Reference (bugs.launchpad.net)
Maturity: unknown
Exploit Reference (youtube.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian1 product
- gnome-keyringAll versions (No fix recorded)
Gnome1 product
- gnome-keyring≤ 3.28.2
2 vendors · 2 products
References
6 links- bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1780365ExploitIssue TrackingThird Party Advisory
