Important: freerdp security update
Summary
ALSA-2021:4622: Important: freerdp security update. Affects freerdp versions < 2:2.2.0-7.el8_5. Fixed in 2:2.2.0-7.el8_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Vulnerability Detail
The freerdp package is affected by two security vulnerabilities:
-
CVE-2021-41159: This vulnerability is caused by improper client input validation for gateway connections, which allows an attacker to overwrite memory.
-
CVE-2021-41160: This vulnerability is caused by improper region checks in all clients, which allow an out-of-bound write to memory.
These vulnerabilities can have a significant impact on the security of systems using FreeRDP, potentially leading to unauthorized access or remote code execution.
How To Fix
Minimum fixed version
2:2.2.0-7.el8_5
This is the first release that contains the fix.
sudo dnf update freerdpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the freerdp package to version 2.2.0-7.el8_5 or later to mitigate the security vulnerabilities. Failure to do so may expose systems to unauthorized access or remote code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for freerdp →
FAQ
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP) that allows users to connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
These vulnerabilities can allow an attacker to overwrite memory or perform out-of-bound writes, potentially leading to unauthorized access or remote code execution.
Yes, all versions of FreeRDP prior to 2.2.0-7.el8_5 are affected by these vulnerabilities.
No specific workaround is mentioned for these vulnerabilities. It is recommended to update to the latest version of the freerdp package.
You can find more information about these vulnerabilities, including the impact, CVSS score, and acknowledgments, on the respective CVE pages: CVE-2021-41159 and CVE-2021-41160.
Related vulnerabilities
Recent vulnerabilities recorded for freerdp.
