CVE-2022-39282

NameCVE-2022-39282
DescriptionFreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3654-1
Debian Bugs1021659

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
freerdp2 (PTS)buster2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u2vulnerable
buster (security)2.3.0+dfsg1-2+deb10u4fixed
bullseye2.3.0+dfsg1-2+deb11u1vulnerable
bookworm2.10.0+dfsg1-1fixed
sid, trixie2.11.2+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
freerdp2sourcebuster2.3.0+dfsg1-2+deb10u4DLA-3654-1
freerdp2source(unstable)2.8.1+dfsg1-11021659

Notes

[bullseye] - freerdp2 <no-dsa> (Minor issue)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq
patch likely: https://github.com/FreeRDP/FreeRDP/commit/60aac2abf0740dd36b62712fba91498fd6e055fe (not confirmed by upstream)

Search for package or bug name: Reporting problems