CVE catalog

CVE-2024-5148

GNOME Remote Desktop vulnerability

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.57% · Oct 25, 2026

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangnome-remote-desktopsid51.0-1not affected
Debiangnome-remote-desktopforky51.0-1not affected
Debiangnome-remote-desktoptrixie48.1-4not affected
Debiangnome-remote-desktopbookworm43.3-1not affected
Ubuntugnome-remote-desktopnobleNot reportednot affected
Ubuntugnome-remote-desktopnoble46.2-1~ubuntu24.04.2fixed
Ubuntugnome-remote-desktop24.0445.0-1vulnerable
Ubuntugnome-remote-desktop24.0445.1-1vulnerable
Ubuntugnome-remote-desktop24.0445.1-1build1vulnerable
Ubuntugnome-remote-desktop24.0446~rc-0ubuntu2vulnerable
Ubuntugnome-remote-desktop24.0446.0-2vulnerable
Ubuntugnome-remote-desktop24.0446.1-1vulnerable
Ubuntugnome-remote-desktop24.0446.2-1~ubuntu24.04.2fixed
Opensusegnome-remote-desktoptumbleweed46.2-1.1fixed
Ubuntugnome-remote-desktop24.0445.0-1vulnerable
Ubuntugnome-remote-desktop24.0445.1-1vulnerable
Ubuntugnome-remote-desktop24.0445.1-1build1vulnerable
Ubuntugnome-remote-desktop24.0446~rc-0ubuntu2vulnerable
Ubuntugnome-remote-desktop24.0446.0-2vulnerable
Ubuntugnome-remote-desktop24.0446.1-1vulnerable
Ubuntugnome-remote-desktop24.0446.2-1~ubuntu24.04.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangnome-remote-desktopsourcesidNot affectedunimportantNot reportedNot reported
Debiangnome-remote-desktopsourceforkyNot affectedunimportantNot reportedNot reported
Debiangnome-remote-desktopsourcetrixieNot affectedunimportantNot reportedNot reported
Debiangnome-remote-desktopsourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntugnome-remote-desktopdebnoble46.2-1~ubuntu24.04.2Not reportedNot reportedNot reported
Ubuntugnome-remote-desktopdeb24.0446.2-1~ubuntu24.04.2Not reportedUSN-6785-1Not reported
Opensusegnome-remote-desktoprpmtumbleweed46.2-1.1Not reportedOPENSUSE-SU-2024:14002-1Not reported
Ubuntugnome-remote-desktopdeb24.0446.2-1~ubuntu24.04.2Not reportedUBUNTU-CVE-2024-5148Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[Debian 12 (Bookworm)]

  • [gnome-remote-desktop]Not affected
    Details (2)

    • 43.3-1 · amd64 · bookworm

      Not affected

      usn · gnome-remote-desktop · debian · bookworm

    • 43.3-1 · arm64 · bookworm

      Not affected

      usn · gnome-remote-desktop · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]