FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
References
| Link | Resource |
|---|---|
| https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0 | Release Notes Third Party Advisory |
| https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhh | Third Party Advisory |
| https://github.com/FreeRDP/FreeRDP/pull/7750 | Patch Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOYKBQOHSRM7JQYUIYUWFOXI2JZ2J5RD/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY/ | Mailing List Third Party Advisory |
| https://security.gentoo.org/glsa/202210-24 | Third Party Advisory |
Advertisement
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Information
Published : 2022-04-26 09:15
Updated : 2022-11-16 11:54
NVD link : CVE-2022-24882
Mitre link : CVE-2022-24882
JSON object : View
CWE
CWE-287
Improper Authentication
Advertisement
Products Affected
fedoraproject
- extra_packages_for_enterprise_linux
- fedora
freerdp
- freerdp