[Bug 1767918] Re: Login password from GDM is shown in plain text on the VT1 console

[Brian Murray]

Hello SimonWerner, or anyone else affected,

Accepted plymouth into bionic-proposed. The package will build now and
be available at
https://launchpad.net/ubuntu/+source/plymouth/0.9.3-1ubuntu7.18.04.1 in
a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-bionic to verification-done-bionic. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-bionic. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: plymouth (Ubuntu Bionic)
       Status: Triaged => Fix Committed

** Tags added: verification-needed verification-needed-bionic

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to plymouth in Ubuntu.
https://bugs.launchpad.net/bugs/1767918

Title:
  Login password from GDM is shown in plain text on the VT1 console

Status in gdm3 package in Ubuntu:
  Invalid
Status in plymouth package in Ubuntu:
  Fix Released
Status in gdm3 source package in Bionic:
  New
Status in plymouth source package in Bionic:
  Fix Committed

Bug description:
  [Impact]
  Sessions in specific circumstances when switching to TTY while plymouth is being activated or deactivated.

  [Test cases]
  Steps to reproduce:
  1) Log-in using X11 login via GDM.
  2) Use the desktop for a while.  (For some reason I cannot reproduce if I login and then restart after a short while).
  3) In Gnome click System menu -> Power Button -> Restart
  4) Quickly press CTRL-ALT-F1

  Validate whether your login password is visible on the TTY.

  [Regression Potential]
  Possible regressions may include difficulty showing text-mode splash or boot messages given that this changes the state of tty based on plymouth's own activation state.

  ---

  https://gitlab.gnome.org/GNOME/gdm/issues/408

  
  I don't which package this applies to, but I believe the best bet is GDM.

  Steps to reproduce:
  1) Log-in using X11 login via GDM.
  2) Use the desktop for a while.  (For some reason I cannot reproduce if I login and then restart after a short while).
  3) In Gnome click System menu -> Power Button -> Restart
  4) Quickly press CTRL-ALT-F1
  5) I see my login password in plain text in the console.  Once I saw the login password repeated twice.

  See attached photo with the login password blanked out.  Below the
  password is the console cursor.

  ## lsb_release -rd
  Description:	Ubuntu 18.04 LTS
  Release:	18.04

  ## apt-cache policy gdm3
  gdm3:
    Installed: 3.28.0-0ubuntu1
    Candidate: 3.28.0-0ubuntu1
    Version table:
   *** 3.28.0-0ubuntu1 500
          500 http://nz.archive.ubuntu.com/ubuntu bionic/main amd64 Packages
          100 /var/lib/dpkg/status

  ProblemType: Bug
  DistroRelease: Ubuntu 18.04
  Package: gdm3 3.28.0-0ubuntu1
  ProcVersionSignature: Ubuntu 4.15.0-18.19-generic 4.15.17
  Uname: Linux 4.15.0-18-generic x86_64
  ApportVersion: 2.20.9-0ubuntu7
  Architecture: amd64
  CurrentDesktop: ubuntu:GNOME
  Date: Mon Apr 30 14:54:07 2018
  InstallationDate: Installed on 2018-04-13 (17 days ago)
  InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Beta amd64 (20180404)
  SourcePackage: gdm3
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gdm3/+bug/1767918/+subscriptions