CVE-2020-14391
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2,...
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.
- Record
CVE-2020-14391- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
CVE List No score
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.
- Record
CVE-2020-14391- Weakness
- CWE-522
- Updated
- 2026-11-02
EUVDEUVD-2020-6530 No score
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.
- Record
EUVD-2020-6530- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-95g9-pcvg-9462
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2,...
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.
- Record
GHSA-95g9-pcvg-9462- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVRHSA-2020:4451
Red Hat Security Advisory: GNOME security, bug fix, and enhancement update
- Record
RHSA-2020:4451- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0266
Red Hat Security Advisory: gnome-settings-daemon security update
- Record
RHSA-2021:0266- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRLSA-2020:4451
Moderate: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of Rocky Linux.
The following packages have been upgraded to a later upstream version: gnome-remote-desktop (0.1.8), pipewire (0.3.6), vte291 (0.52.4), webkit2gtk3 (2.28.4), xdg-desktop-portal (1.6.0), xdg-desktop-portal-gtk (1.6.0). (BZ#1775345, BZ#1779691, BZ#1817143, BZ#1832347, BZ#1837406)
Security Fix(es):
-
webkitgtk: Multiple security issues (CVE-2019-8625, CVE-2019-8710, CVE-2019-8720, CVE-2019-8743, CVE-2019-8764, CVE-2019-8766, CVE-2019-8769, CVE-2019-8771, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846, CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, CVE-2020-3885, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806, CVE-2020-9807, CVE-2020-9843, CVE-2020-9850, CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925, CVE-2020-10018, CVE-2020-11793)
-
gnome-settings-daemon: Rocky Enterprise Software Foundation Customer Portal password logged and passed as command line argument when user registers through GNOME control center (CVE-2020-14391)
-
LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.
- Record
RLSA-2020:4451- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2020:4451 No score
Moderate: GNOME security, bug fix, and enhancement update
GNOME is the default desktop environment of AlmaLinux.
The following packages have been upgraded to a later upstream version: gnome-remote-desktop (0.1.8), pipewire (0.3.6), vte291 (0.52.4), webkit2gtk3 (2.28.4), xdg-desktop-portal (1.6.0), xdg-desktop-portal-gtk (1.6.0). (BZ#1775345, BZ#1779691, BZ#1817143, BZ#1832347, BZ#1837406)
Security Fix(es):
-
webkitgtk: Multiple security issues (CVE-2019-8625, CVE-2019-8710, CVE-2019-8720, CVE-2019-8743, CVE-2019-8764, CVE-2019-8766, CVE-2019-8769, CVE-2019-8771, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846, CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, CVE-2020-3885, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806, CVE-2020-9807, CVE-2020-9843, CVE-2020-9850, CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925, CVE-2020-10018, CVE-2020-11793)
-
gnome-settings-daemon: AlmaLinux Customer Portal password logged and passed as command line argument when user registers through GNOME control center (CVE-2020-14391)
-
LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2020:4451- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
LibRaw-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.19.5-2.el8 | 0.19.5-2.el8 |
PackageKitAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-command-not-foundAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-cronAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-glibAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-glib-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-gstreamer-pluginAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
PackageKit-gtk3-moduleAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.1.12-6.el8 | 1.1.12-6.el8 |
dleyna-rendererAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.6.0-3.el8 | 0.6.0-3.el8 |
frei0r-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.6.1-7.el8 | 1.6.1-7.el8 |
Show 69 moreShow less
| Package | Affected | Fixed |
|---|---|---|
frei0r-pluginsAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.6.1-7.el8 | 1.6.1-7.el8 |
frei0r-plugins-opencvAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.6.1-7.el8 | 1.6.1-7.el8 |
gnome-remote-desktopAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.1.8-3.el8 | 0.1.8-3.el8 |
gtk-docAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.28-2.el8 | 1.28-2.el8 |
gvfsAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.36.2-10.el8 | 1.36.2-10.el8 |
libsoupAlmaLinux:8 From an advisory covering 57 CVEs |
before 2.62.3-2.el8 | 2.62.3-2.el8 |
libsoup-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 2.62.3-2.el8 | 2.62.3-2.el8 |
mutter-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.32.2-48.el8 | 3.32.2-48.el8 |
nautilusAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.1-14.el8 | 3.28.1-14.el8 |
nautilus-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.1-14.el8 | 3.28.1-14.el8 |
pipewireAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire-docAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire-libsAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire-utilsAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3.6-1.el8 | 0.3.6-1.el8 |
pipewire0.2-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.2.7-6.el8 | 0.2.7-6.el8 |
pipewire0.2-libsAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.2.7-6.el8 | 0.2.7-6.el8 |
potraceAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.15-3.el8 | 1.15-3.el8 |
pygobject3-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.3-2.el8 | 3.28.3-2.el8 |
python3-gobjectAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.3-2.el8 | 3.28.3-2.el8 |
python3-gobject-baseAlmaLinux:8 From an advisory covering 57 CVEs |
before 3.28.3-2.el8 | 3.28.3-2.el8 |
trackerAlmaLinux:8 From an advisory covering 57 CVEs |
before 2.1.5-2.el8 | 2.1.5-2.el8 |
tracker-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 2.1.5-2.el8 | 2.1.5-2.el8 |
vte-profileAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.52.4-2.el8 | 0.52.4-2.el8 |
vte291AlmaLinux:8 From an advisory covering 57 CVEs |
before 0.52.4-2.el8 | 0.52.4-2.el8 |
vte291-develAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.52.4-2.el8 | 0.52.4-2.el8 |
webrtc-audio-processingAlmaLinux:8 From an advisory covering 57 CVEs |
before 0.3-9.el8 | 0.3-9.el8 |
xdg-desktop-portal-gtkAlmaLinux:8 From an advisory covering 57 CVEs |
before 1.6.0-1.el8 | 1.6.0-1.el8 |
webkit2gtk3Red Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-develRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-jscRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:2.28.4-1.el8 | 0:2.28.4-1.el8 |
gnome-settings-daemonRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:3.32.0-11.el8 | 0:3.32.0-11.el8 |
gnome-settings-daemon-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:3.32.0-11.el8 | 0:3.32.0-11.el8 |
gnome-settings-daemon-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:3.32.0-11.el8 | 0:3.32.0-11.el8 |
LibRawRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-samples-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-debuginfoRed Hat:enterprise_linux:8::crb From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-debugsourceRed Hat:enterprise_linux:8::crb From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-develRed Hat:enterprise_linux:8::crb From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
LibRaw-samples-debuginfoRed Hat:enterprise_linux:8::crb From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
gnome-settings-daemonRed Hat:rhel_eus:8.2::appstream |
before 0:3.32.0-9.el8_2.1 | 0:3.32.0-9.el8_2.1 |
gnome-settings-daemon-debuginfoRed Hat:rhel_eus:8.2::appstream |
before 0:3.32.0-9.el8_2.1 | 0:3.32.0-9.el8_2.1 |
gnome-settings-daemon-debugsourceRed Hat:rhel_eus:8.2::appstream |
before 0:3.32.0-9.el8_2.1 | 0:3.32.0-9.el8_2.1 |
dleyna-rendererRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.6.0-3.el8 | 0:0.6.0-3.el8 |
frei0r-pluginsRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.6.1-7.el8 | 0:1.6.1-7.el8 |
gnome-remote-desktopRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.1.8-3.el8 | 0:0.1.8-3.el8 |
gnome-sessionRocky Linux:8 From an advisory covering 57 CVEs |
before 0:3.28.1-10.el8 | 0:3.28.1-10.el8 |
gsettings-desktop-schemasRocky Linux:8 From an advisory covering 57 CVEs |
before 0:3.32.0-5.el8 | 0:3.32.0-5.el8 |
gtk3Rocky Linux:8 From an advisory covering 57 CVEs |
before 0:3.22.30-6.el8 | 0:3.22.30-6.el8 |
LibRawRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.19.5-2.el8 | 0:0.19.5-2.el8 |
libsoupRocky Linux:8 From an advisory covering 57 CVEs |
before 0:2.62.3-2.el8 | 0:2.62.3-2.el8 |
PackageKitRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.1.12-6.el8 | 0:1.1.12-6.el8 |
PackageKitRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.1.12-6.el8.0.2 | 0:1.1.12-6.el8.0.2 |
pipewire0.2Rocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.2.7-6.el8 | 0:0.2.7-6.el8 |
pipewireRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.3.6-1.el8 | 0:0.3.6-1.el8 |
potraceRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.15-3.el8 | 0:1.15-3.el8 |
pygobject3Rocky Linux:8 From an advisory covering 57 CVEs |
before 0:3.28.3-2.el8 | 0:3.28.3-2.el8 |
trackerRocky Linux:8 From an advisory covering 57 CVEs |
before 0:2.1.5-2.el8 | 0:2.1.5-2.el8 |
vte291Rocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.52.4-2.el8 | 0:0.52.4-2.el8 |
webrtc-audio-processingRocky Linux:8 From an advisory covering 57 CVEs |
before 0:0.3-9.el8 | 0:0.3-9.el8 |
xdg-desktop-portal-gtkRocky Linux:8 From an advisory covering 57 CVEs |
before 0:1.6.0-1.el8 | 0:1.6.0-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-14391 is a medium vulnerability (CVSS 5.5) in Gnome Control Center, published November 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in gnome-settings-daemon 0:3.32.0-9.el8_2.1.
References
bugzilla.redhat.com/show_bug.cgi?id=1873093
nvd.nist.gov/vuln/detail/CVE-2020-14391
access.redhat.com/errata/RHSA-2020:4451
github.com/advisories/GHSA-95g9-pcvg-9462
Show 194 moreShow less
errata.almalinux.org/8/ALSA-2020-4451.html
vulners.com/cve/CVE-2019-8625
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4451.json
cve.org/CVERecord?id=CVE-2019-8625
webkitgtk.org/security/WSA-2019-0005.html
cisa.gov/known-exploited-vulnerabilities-catalog
errata.rockylinux.org/RLSA-2020:4451
Left out here: 151 references. The JSON record has them.