Log in Start free

Vulnerability · Published Oct 12, 2022 · Assigned by GitHub_M

CVE-2022-39282RDP client: Read of uninitialized memory with parallel port redirection

Low 3.5

In plain English

A low-severity security flaw in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8freerdp2:2.2.0-10.el8ALSA-2023:2851
AlmaLinux:9freerdp2:2.4.1-5.el9ALSA-2023:2326
AlmaLinux:8freerdp-devel2:2.2.0-10.el8ALSA-2023:2851
AlmaLinux:9freerdp-devel2:2.4.1-5.el9ALSA-2023:2326
AlmaLinux:8freerdp-libs2:2.2.0-10.el8ALSA-2023:2851
AlmaLinux:9freerdp-libs2:2.4.1-5.el9ALSA-2023:2326
AlmaLinux:8libwinpr2:2.2.0-10.el8ALSA-2023:2851
AlmaLinux:9libwinpr2:2.4.1-5.el9ALSA-2023:2326
AlmaLinux:8libwinpr-devel2:2.2.0-10.el8ALSA-2023:2851
AlmaLinux:9libwinpr-devel2:2.4.1-5.el9ALSA-2023:2326
Debian:12freerdp22.8.1+dfsg1-1DEBIAN-CVE-2022-39282
Rocky Linux:8freerdp2:2.2.0-10.el8RLSA-2023:2851
Ubuntu:22.04:LTSfreerdp22.6.1+dfsg1-3ubuntu2.3USN-5734-1
Ubuntu:22.04:LTSfreerdp22.6.1+dfsg1-3ubuntu2.3UBUNTU-CVE-2022-39282

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP <= 2.8.0

Weakness: CWE-908 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References