[Bug 847718] New: Typed password on the GNOME lock screen is not hidden if IBus is active

newer
[Bug 906143] New: ibus-mozc with...

bugzilla_noreply＠novell.com

25 Oct 2013 25 Oct '13

16:55

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c0 Summary: Typed password on the GNOME lock screen is not hidden if IBus is active Classification: openSUSE Product: openSUSE 13.1 Version: RC 1 Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME AssignedTo: bnc-team-gnome@forge.provo.novell.com ReportedBy: ftake@geeko.jp QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Opera/9.80 (Macintosh; Intel Mac OS X 10.8.5) Presto/2.12.388 Version/12.16 IBus 1.5.4 now supports input purpose to control how typed characters are shown on the password box. However, IBus engines that does not support this change may show typed characters on password box of GNOME lock screen if they are active: https://groups.google.com/forum/#!topic/ibus-user/mvCHDO1BJUw This problem affects, at least, the following IBus engines: - ibus-mozc (The upstream provides a patch to fix this) - ibus-anthy (fixed in 1.5.4) - ibus-pinyin - ibus-chewing Reproducible: Always Steps to Reproduce: 1. Activate IBus engines above 2. Lock screen 3. Type keys on password box -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

bugzilla_noreply＠novell.com

25 Oct 25 Oct

16:56

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c Fuminobu Takeyama changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-gnome@forge.provo. |ftake@geeko.jp |novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

17:44

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c1 Takashi Iwai changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-team@suse.de, | |tiwai@suse.com --- Comment #1 from Takashi Iwai 2013-10-25 17:44:30 UTC --- Sounds like a serious security issue to me. Added security team to Cc. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

23:57

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c2 --- Comment #2 from Kurt Seifried 2013-10-25 23:57:04 UTC --- Can someone from the SuSE security team confirm this? If so I'll assign a CVE for this. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

26 Oct 26 Oct

06:12

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c3 --- Comment #3 from Fuminobu Takeyama 2013-10-26 06:11:59 UTC --- I have tested other engines. All typed characters are shown (but converted to Chinese characters etc): - ibus-mozc (The upstream provides a patch to fix this) http://code.google.com/p/mozc/issues/detail?id=199 - ibus-anthy (fixed in 1.5.4) - ibus-pinyin - ibus-chewing Only the last character is shown like IM on tablets or smart phones - ibus-m17n - ibus-hangul No effect - ibus-input-pad This commit log in ibus-anty will be helpful to fix other engines. https://github.com/ibus/ibus-anthy/commit/6aae0a9f145f536515e268dd6b25aa740a... + if self.__has_input_purpose and \ + self.__input_purpose == IBus.InputPurpose.PASSWORD: + return False Workarounds: Users should confirm the current engine is a xkb:* engine or anthy/mozc is in direct input mode before typing password on GNOME lock screen. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

06:15

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c4 --- Comment #4 from Fuminobu Takeyama 2013-10-26 06:15:23 UTC --- (In reply to comment #2)

...

Can someone from the SuSE security team confirm this? If so I'll assign a CVE for this.

As far as I know, nobody has not yet. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:21

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c5 --- Comment #5 from Fuminobu Takeyama 2013-10-26 15:21:17 UTC --- <del>As far as I know, nobody has not yet.</del> As far as I know, nobody from the security team has confirmed yet. I prepared a repository and updated ibus-mozc and ibus-anthy for submitting to 13.1:Update https://build.opensuse.org/project/show/home:ftake:branches:openSUSE:13.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

28 Oct 28 Oct

15:39

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c6 --- Comment #6 from Fuminobu Takeyama 2013-10-28 15:39:53 UTC --- It seems that we need another patch for ibus: https://bugzilla.redhat.com/show_bug.cgi?id=1013948 ibus 1.5.4 does not include this commit: https://github.com/ibus/ibus/commit/9596aea2e2df4cd3ac9b795ad9f354723cf83317 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

31 Oct 31 Oct

14:33

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c7 --- Comment #7 from Takashi Iwai 2013-10-31 14:33:22 UTC --- I confirmed the issue on freshly installed 13.1-RC2 on KVM. The repo in comment 5 fixes the issue with mozc, at least. Didn't test other IMs yet, though. The fix mentioned in comment 6 is just to make the ibus-side content type delegation more consistent. I quickly applied a fix and tested, it seems working, at least nothing worse. Now ibus is submitted to M17N via SRID 205368. Of course, this ibus fix does anything useful unless the IM engines support the IBus.InputPurpose.PASSWORD check. Takeyama-san, could you submit your fixes? I don't think these fixes would conflict if anything fundamental will be fixed later in the ibus core side. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

16:00

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c8 --- Comment #8 from Bernhard Wiedemann 2013-10-31 17:00:24 CET --- This is an autogenerated message for OBS integration: This bug (847718) was mentioned in https://build.opensuse.org/request/show/205379 Factory / ibus -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

1 Nov 1 Nov

09:00

New subject: [Bug 847718] Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c9 --- Comment #9 from Bernhard Wiedemann 2013-11-01 10:00:29 CET --- This is an autogenerated message for OBS integration: This bug (847718) was mentioned in https://build.opensuse.org/request/show/205491 13.1 / mozc https://build.opensuse.org/request/show/205492 13.1 / ibus.openSUSE_13.1 https://build.opensuse.org/request/show/205493 13.1 / ibus-anthy -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12:10

New subject: [Bug 847718] VUL-0: ibus: Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Typed password on the GNOME |VUL-0: ibus: Typed password |lock screen is not hidden |on the GNOME lock screen is |if IBus is active |not hidden if IBus is | |active -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

13:53

New subject: [Bug 847718] VUL-0: ibus: Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c10 --- Comment #10 from Fuminobu Takeyama 2013-11-01 13:53:41 UTC --- (In reply to comment #7)

...

Of course, this ibus fix does anything useful unless the IM engines support the IBus.InputPurpose.PASSWORD check. Takeyama-san, could you submit your fixes?

Sorry, I didn't noticed your comment because Bugzilla didn't send any notification. As the message from OBS says, I have submitted updated packages to 13.1. I am waiting the requests are accepted. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:31

New subject: [Bug 847718] VUL-0: ibus: Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c11 Victor Pereira changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |vpereira@novell.com --- Comment #11 from Victor Pereira 2013-11-01 14:31:18 UTC --- do we have already a CVE assigned to it? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

23:00

New subject: [Bug 847718] VUL-0: ibus: Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c12 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #12 from Swamp Workflow Management 2013-11-01 23:00:19 UTC --- bugbot adjusting priority -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

4 Nov 4 Nov

12:38

New subject: [Bug 847718] VUL-0: ibus: Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c13 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@suse.com --- Comment #13 from Marcus Meissner 2013-11-04 12:38:32 UTC --- posted cve requestd on oss-sec -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:23

New subject: [Bug 847718] VUL-0: ibus: Typed password on the GNOME lock screen is not hidden if IBus is active

https://bugzilla.novell.com/show_bug.cgi?id=847718 https://bugzilla.novell.com/show_bug.cgi?id=847718#c14 Fuminobu Takeyama changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |Final --- Comment #14 from Fuminobu Takeyama 2013-11-04 15:23:06 UTC --- Can we put these fix into 13.1 GM? IBus and Mozc have been checked in Factory, but I cannot see response from maintainance team. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.