Vulnerabilidades / CVE-2022-23478

crítica

CVE-2022-23478

xrdp is an open source project which provides a graphical login to rem ...

Publicada Modificada CWE 787
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media).

Descripción

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue. Users are advised to upgrade.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
alpine 3.17xrdp0.9.21.1-r0
alpine 3.18xrdp0.9.21.1-r0
alpine 3.19xrdp0.9.21.1-r0
alpine 3.20xrdp0.9.21.1-r0
alpine 3.21xrdp0.9.21.1-r0
alpine 3.22xrdp0.9.21.1-r0
alpine 3.23xrdp0.9.21.1-r0
alpine 3.24xrdp0.9.21.1-r0
alpine edgexrdp0.9.21.1-r0
debian 10xrdp0.9.9-1+deb10u2
debian 11xrdp0.9.21.1-1~deb11u1
debian 12xrdp0.9.21.1-1
Mostrar las 20 entradas de 20 fuentes
FuentePaqueteCorregido en
alpine 3.17xrdp0.9.21.1-r0
alpine 3.18xrdp0.9.21.1-r0
alpine 3.19xrdp0.9.21.1-r0
alpine 3.20xrdp0.9.21.1-r0
alpine 3.21xrdp0.9.21.1-r0
alpine 3.22xrdp0.9.21.1-r0
alpine 3.23xrdp0.9.21.1-r0
alpine 3.24xrdp0.9.21.1-r0
alpine edgexrdp0.9.21.1-r0
debian 10xrdp0.9.9-1+deb10u2
debian 11xrdp0.9.21.1-1~deb11u1
debian 12xrdp0.9.21.1-1
debian 13xrdp0.9.21.1-1
debian 14xrdp0.9.21.1-1
echoxrdp0.9.21.1-1
rapidfort ubuntu 20.04xrdp0:0.9.21.1-1
rapidfort ubuntu 22.04xrdp0:0.9.21.1-1
rapidfort ubuntu 24.04xrdp0:0.9.21.1-1
ubuntu 20.04-ESMxrdp0.9.12-1ubuntu0.1+esm1
ubuntu 22.04xrdpsin corrección indicada

Referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.