115 lines
7.8 KiB
XML
115 lines
7.8 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for gnome-shell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2021-1403</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2021-10-30</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2021-10-30</InitialReleaseDate>
|
|
<CurrentReleaseDate>2021-10-30</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2021-10-30</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">gnome-shell security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for gnome-shell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">The GNOME Shell redefines user interactions with the GNOME desktop. In particular, it offers new paradigms for launching applications, accessing documents, and organizing open windows in GNOME. Later, it will introduce a new applets eco-system and offer new solutions for other desktop features, such as notifications and contacts management. The GNOME Shell is intended to replace functions handled by the GNOME Panel and by the window manager in previous versions of GNOME. The GNOME Shell has rich visual effects enabled by new graphical technologies.
|
|
|
|
Security Fix(es):
|
|
|
|
It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.(CVE-2019-3820)</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for gnome-shell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.
|
|
|
|
openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">Medium</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">gnome-shell</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1403</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2019-3820</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2019-3820</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">openEuler-20.03-LTS-SP2</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="gnome-shell-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gnome-shell-3.30.1-10.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-debugsource-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gnome-shell-debugsource-3.30.1-10.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-debuginfo-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gnome-shell-debuginfo-3.30.1-10.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">gnome-shell-3.30.1-10.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-debugsource-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">gnome-shell-debugsource-3.30.1-10.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-debuginfo-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">gnome-shell-debuginfo-3.30.1-10.oe1.aarch64.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="noarch">
|
|
<FullProductName ProductID="gnome-shell-help-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gnome-shell-help-3.30.1-10.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-help-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">gnome-shell-help-3.30.1-10.oe1.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="gnome-shell-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gnome-shell-3.30.1-10.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">gnome-shell-3.30.1-10.oe1.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="gnome-shell-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gnome-shell-3.30.1-10.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-debuginfo-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gnome-shell-debuginfo-3.30.1-10.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-debugsource-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">gnome-shell-debugsource-3.30.1-10.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">gnome-shell-3.30.1-10.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-debuginfo-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">gnome-shell-debuginfo-3.30.1-10.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="gnome-shell-debugsource-3.30.1-10" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">gnome-shell-debugsource-3.30.1-10.oe1.x86_64.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2021-10-30</ReleaseDate>
|
|
<CVE>CVE-2019-3820</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP2</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>Medium</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>4.3</BaseScore>
|
|
<Vector>AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>gnome-shell security update</Description>
|
|
<DATE>2021-10-30</DATE>
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1403</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc> |