Not Failing Securely ('Failing Open') Affecting webkit2gtk3 package, versions <0:2.30.4-1.el8


Severity

Recommended
0.0
medium
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.08% (38th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-WEBKIT2GTK3-3968226
  • published26 Jul 2021
  • disclosed10 Nov 2020

Introduced: 10 Nov 2020

CVE-2020-16125  (opens in a new tab)
CWE-636  (opens in a new tab)

How to fix?

Upgrade RHEL:8 webkit2gtk3 to version 0:2.30.4-1.el8 or higher.
This issue was patched in RHSA-2021:1586.

NVD Description

Note: Versions mentioned in the description apply only to the upstream webkit2gtk3 package and not the webkit2gtk3 package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially derivatives) this could be be chained with an additional issue that could allow a local user to create a new privileged account.

CVSS Scores

version 3.1