Vulnerability · Published Aug 11, 2020 · Assigned by mitre
CVE-2020-17448
High 7.8
In plain English
A high-severity security flaw in the telegram-desktop package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)2.3%top 16.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | telegram-desktop | 2.2.0+ds-1 | DEBIAN-CVE-2020-17448 |
| Debian:14 | telegram-desktop | 2.2.0+ds-1 | DEBIAN-CVE-2020-17448 |
Affected products (as reported)
References
- https://telegram.org x_refsource_MISC
- https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram-CVE-2020-17448 x_refsource_MISC
- https://github.com/telegramdesktop/tdesktop/releases/tag/v2.2.0 x_refsource_MISC
- GLSA-202101-34 vendor-advisory, x_refsource_GENTOO