Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-18 Thread Moritz Muehlenhoff
On Mon, Sep 18, 2023 at 07:27:24AM +0200, Salvatore Bonaccorso wrote: > Moritz is taking care of releasing the DSA. Indeed, all builds are in, I'll release tonight. Cheers, Moritz

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Salvatore Bonaccorso
Hi Simon, On Sun, Sep 17, 2023 at 09:24:19PM +0100, Simon McVittie wrote: > On Sun, 17 Sep 2023 at 20:57:36 +0200, Salvatore Bonaccorso wrote: > > On Sun, Sep 17, 2023 at 07:09:45PM +0100, Simon McVittie wrote: > > > As far as I can tell, oldstable is not affected by this, because it > > >

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Simon McVittie
On Sun, 17 Sep 2023 at 20:57:36 +0200, Salvatore Bonaccorso wrote: > On Sun, Sep 17, 2023 at 07:09:45PM +0100, Simon McVittie wrote: > > As far as I can tell, oldstable is not affected by this, because it > > doesn't appear to have the new screenshot UI in js/ui/screenshot.js that > > has the

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Salvatore Bonaccorso
Hi Simon, On Sun, Sep 17, 2023 at 07:09:45PM +0100, Simon McVittie wrote: > On Sun, 17 Sep 2023 at 19:39:24 +0200, Moritz Mühlenhoff wrote: > > Does this also affect oldstable? > > As far as I can tell, oldstable is not affected by this, because it > doesn't appear to have the new screenshot UI

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Simon McVittie
On Sun, 17 Sep 2023 at 19:39:24 +0200, Moritz Mühlenhoff wrote: > Does this also affect oldstable? As far as I can tell, oldstable is not affected by this, because it doesn't appear to have the new screenshot UI in js/ui/screenshot.js that has the vulnerability. Pressing Print Screen in the lock

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Simon McVittie
On Sun, 17 Sep 2023 at 19:39:24 +0200, Moritz Mühlenhoff wrote: > please build with -sa (ftp.d.o and security.d.o don't share tarballs) I'm sorry, I should have checked more carefully. > Does this also affect oldstable? I'm sorry, I haven't checked that yet. > If so, can you please also

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Moritz Mühlenhoff
Am Sun, Sep 17, 2023 at 06:22:00PM +0100 schrieb Simon McVittie: > On Sun, 17 Sep 2023 at 18:17:56 +0100, Simon McVittie wrote: > > I can upload this to security-master if wanted, or the security > > team or other GNOME team members are welcome to sponsor it > > or upload their own version if they

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Simon McVittie
On Sun, 17 Sep 2023 at 18:17:56 +0100, Simon McVittie wrote: > I can upload this to security-master if wanted, or the security > team or other GNOME team members are welcome to sponsor it > or upload their own version if they would like to take my > response time off the critical path. Unsigned

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Simon McVittie
On Sun, 17 Sep 2023 at 16:49:59 +0200, Salvatore Bonaccorso wrote: > In this case we even not have yet decided if it's warranted or not, > but I just aimed to make an unstable report to get it for sure fixed > there already. > > Lets decide on it and either me or another team member will come

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Salvatore Bonaccorso
Hi Simon, On Sun, Sep 17, 2023 at 03:12:00PM +0100, Simon McVittie wrote: > On Sat, 16 Sep 2023 at 22:53:55 +0200, Salvatore Bonaccorso wrote: > > The following vulnerability was published for gnome-shell. > > > > CVE-2023-43090[0]: > > | Screenshot tool allows viewing open windows when session

Bug#1052067: gnome-shell: CVE-2023-43090: screenshot tool allows viewing open windows when session is locked

2023-09-17 Thread Simon McVittie
On Sat, 16 Sep 2023 at 22:53:55 +0200, Salvatore Bonaccorso wrote: > The following vulnerability was published for gnome-shell. > > CVE-2023-43090[0]: > | Screenshot tool allows viewing open windows when session is locked Thank you for reporting this. I'm preparing a 44.5 upload for unstable