Unscored severity · published Oct 22, 2012
CVE-2012-3466
GNOME gnome-keyring 3.4.0 through 3.4.1, when gpg-cache-method is set to "idle" or "timeout," does not properly limit the amount of time a passphrase is cached, which allows…
–
CVSS
0.5%
EPSS
No
On KEV
Description
GNOME gnome-keyring 3.4.0 through 3.4.1, when gpg-cache-method is set to "idle" or "timeout," does not properly limit the amount of time a passphrase is cached, which allows attackers to have an unspecified impact via unknown attack vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnome-keyring · Gnome
3.4.0; 3.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3466
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3466
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683655
git.gnome.org
http://git.gnome.org/browse/gnome-keyring/commit/?id=51606f299e5ee9d48096db0a5957efe26cbf7cc3
Patch
http://git.gnome.org/browse/gnome-keyring/commit/?id=5dff623470b859e332dbe12afb0dc57b292832d2
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2012-09/msg00037.html
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2013:084
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/09/1
More from Gnome-keyring
7.8
CVE-2018-20781
In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon
7.8
CVE-2018-19358
GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to…
7.5
CVE-2012-6111
gnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync function