CVE-2020-17489: 
NixOS vulnerability analysis and mitigation

CVE-2020-17489 is a security vulnerability discovered in GNOME gnome-shell through version 3.36.4. The vulnerability was disclosed on August 11, 2020, affecting the GNOME desktop environment's login functionality. The issue occurs in certain configurations where the password box from the login dialog reappears with the password still visible when logging out of an account (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The CVSS v2.0 score is 1.9 (LOW) with the vector (AV:L/AC:M/Au:N/C:P/I:N/A:N). The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials) and requires physical access and user interaction to exploit (NVD).

The impact of this vulnerability varies depending on user configuration. If a user had configured their password to be shown in cleartext at login time, the password becomes visible for a brief moment upon logout. In cases where the password was never shown in cleartext, only the password length is revealed (NVD).

The vulnerability requires physical access to the affected system and specific user interaction. It only manifests when a user logs out of their account and had previously opted to show their password in cleartext during login (NVD).

Multiple vendors have released patches to address this vulnerability. Debian 9 'Stretch' users should upgrade to version 3.22.3-3+deb9u1, Gentoo users should upgrade to version 3.34.5-r1 or later, and openSUSE Leap 15.2 users should apply the security update openSUSE-SU-2020:1861-1 (Debian Advisory, Gentoo Advisory, OpenSUSE Advisory).