CVE catalog
CVE-2018-20839
plymouth: CVE-2018-20839
- Severity
- Medium · CVSS 4.3
CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.48% · Oct 25, 2026
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | plymouth | sid | 26.134.222-1 | fixed |
| Debian | plymouth | forky | 26.134.222-1 | fixed |
| Debian | plymouth | trixie | 24.004.60-5 | fixed |
| Debian | plymouth | bookworm | 22.02.122-3 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | plymouth | source | sid | 0.9.4-1 | low | Not reported | Not reported |
| Debian | plymouth | source | forky | 0.9.4-1 | low | Not reported | Not reported |
| Debian | plymouth | source | trixie | 0.9.4-1 | low | Not reported | Not reported |
| Debian | plymouth | source | bookworm | 0.9.4-1 | low | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libplymouth5]Fixed
Source package: [plymouth]
Details (2)
22.02.122-3· amd64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
22.02.122-3· arm64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
- [libplymouth-dev]Fixed
Source package: [plymouth]
Details (2)
22.02.122-3· amd64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
22.02.122-3· arm64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
- [plymouth]Fixed
Details (2)
22.02.122-3· amd64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
22.02.122-3· arm64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
- [plymouth-label]Fixed
Source package: [plymouth]
Details (2)
22.02.122-3· amd64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
22.02.122-3· arm64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
- [plymouth-themes]Fixed
Source package: [plymouth]
Details (2)
22.02.122-3· amd64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
22.02.122-3· arm64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
- [plymouth-x11]Fixed
Source package: [plymouth]
Details (2)
22.02.122-3· amd64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
22.02.122-3· arm64 · bookwormFixed · Fixed:
0.9.4-1dsa · plymouth · debian · bookworm; dsa · plymouth · debian · 12
[Debian 13 (Trixie)]
- [libplymouth5]Fixed
Source package: [plymouth]
Details (2)
24.004.60-5· amd64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
24.004.60-5· arm64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
- [libplymouth-dev]Fixed
Source package: [plymouth]
Details (2)
24.004.60-5· amd64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
24.004.60-5· arm64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
- [plymouth]Fixed
Details (2)
24.004.60-5· amd64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
24.004.60-5· arm64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
- [plymouth-label]Fixed
Source package: [plymouth]
Details (2)
24.004.60-5· amd64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
24.004.60-5· arm64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
- [plymouth-themes]Fixed
Source package: [plymouth]
Details (2)
24.004.60-5· amd64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
24.004.60-5· arm64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
- [plymouth-x11]Fixed
Source package: [plymouth]
Details (2)
24.004.60-5· amd64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
24.004.60-5· arm64 · trixieFixed · Fixed:
0.9.4-1dsa · plymouth · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2018-20839]
- [https://security-tracker.debian.org/tracker/CVE-2018-20839]
- [https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-20839.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]