kritisch
CVE-2026-91949
freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
Red Hat9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut Red Hat, AlmaLinux, Oracle, Rocky Linux. Niedriger laut Amazon (hoch), Ubuntu (mittel).
Beschreibung
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 10 | freerdp, freerdp-devel, freerdp-libs und 3 weitere | 2:3.10.3-12.el10_2.13 |
| rocky 10 | freerdp, freerdp-libs, libwinpr | 2:3.10.3-12.el10_2.13 |
| amazon linux 2023 | freerdp, freerdp-debuginfo, freerdp-debugsource und 8 weitere | 2:3.31.0-1.amzn2023 |
| debian 13 | freerdp3 | kein Fix angegeben |
| debian 14 | freerdp3 | 3.31.0+dfsg-1 |
| echo | freerdp3 | kein Fix angegeben |
| rapidfort alma 10 | freerdp, freerdp-devel, freerdp-libs und 3 weitere | 2:3.10.3-12.el10_2.13 |
| rapidfort alpine 3.20 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.21 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.22 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.23 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.24 | freerdp | 3.31.0-r0 |
Alle 56 Einträge aus 19 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 10 | freerdp | 2:3.10.3-12.el10_2.13 |
| alma 10 | freerdp-devel | 2:3.10.3-12.el10_2.13 |
| alma 10 | freerdp-libs | 2:3.10.3-12.el10_2.13 |
| alma 10 | freerdp-server | 2:3.10.3-12.el10_2.13 |
| alma 10 | libwinpr | 2:3.10.3-12.el10_2.13 |
| alma 10 | libwinpr-devel | 2:3.10.3-12.el10_2.13 |
| rocky 10 | freerdp | 2:3.10.3-12.el10_2.13 |
| rocky 10 | freerdp-libs | 2:3.10.3-12.el10_2.13 |
| rocky 10 | libwinpr | 2:3.10.3-12.el10_2.13 |
| amazon linux 2023 | freerdp | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-debuginfo | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-debugsource | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-devel | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-libs | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-libs-debuginfo | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-server | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | freerdp-server-debuginfo | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | libwinpr | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | libwinpr-debuginfo | 2:3.31.0-1.amzn2023 |
| amazon linux 2023 | libwinpr-devel | 2:3.31.0-1.amzn2023 |
| debian 13 | freerdp3 | kein Fix angegeben |
| debian 14 | freerdp3 | 3.31.0+dfsg-1 |
| echo | freerdp3 | kein Fix angegeben |
| rapidfort alma 10 | freerdp | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | freerdp-devel | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | freerdp-libs | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | freerdp-server | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | libwinpr | 2:3.10.3-12.el10_2.13 |
| rapidfort alma 10 | libwinpr-devel | 2:3.10.3-12.el10_2.13 |
| rapidfort alpine 3.20 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.21 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.22 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.23 | freerdp | 3.31.0-r0 |
| rapidfort alpine 3.24 | freerdp | 3.31.0-r0 |
| rapidfort amazon linux 2023 | freerdp | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | freerdp-devel | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | freerdp-libs | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | freerdp-server | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | libwinpr | 2:3.31.0-1.amzn2023 |
| rapidfort amazon linux 2023 | libwinpr-devel | 2:3.31.0-1.amzn2023 |
| rapidfort debian 12 | freerdp3 | 0:3.31.0+dfsg-1 |
| rapidfort debian 13 | freerdp3 | 0:3.31.0+dfsg-1 |
| rapidfort fedora 43 | freerdp | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | freerdp-devel | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | freerdp-libs | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | freerdp-server | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | libwinpr | 2:3.31.0-1.fc43 |
| rapidfort fedora 43 | libwinpr-devel | 2:3.31.0-1.fc43 |
| rapidfort Oracle Linux 10 | freerdp | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | freerdp-devel | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | freerdp-libs | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | freerdp-server | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | libwinpr | 2:3.10.3-12.el10_2.13 |
| rapidfort Oracle Linux 10 | libwinpr-devel | 2:3.10.3-12.el10_2.13 |
| ubuntu 24.04 | freerdp3 | 3.31.0+dfsg-0ubuntu0.24.04.1 |
| ubuntu 26.04 | freerdp3 | 3.31.0+dfsg-0ubuntu0.26.04.1 |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:73979
- https://access.redhat.com/security/cve/CVE-2026-91949
- https://bugzilla.redhat.com/2533925
- https://bugzilla.redhat.com/show_bug.cgi?id=2533925
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91949
- https://errata.almalinux.org/10/ALSA-2026-73979.html
- https://errata.rockylinux.org/RLSA-2026:73979
Alle 15 Referenzen
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
- https://linux.oracle.com/cve/CVE-2026-91949.html
- https://linux.oracle.com/errata/ELSA-2026-73979.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-91949
- https://www.cve.org/CVERecord?id=CVE-2026-91949
- https://www.openwall.com/lists/oss-security/2026/09/01/2
- https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass