CVE-2021-37594: Input Validation

Q: What is CVE-2021-37594?

CVE-2021-37594 is a vulnerability in FreeRDP before version 2.4.0 on Windows that allows for missing input checks in the wf_cliprdr_server_file_contents_request function in client/Windows/wf_cliprdr.c, specifically in the FILECONTENTS_SIZE File Contents Request PDU.

Q: What is the severity of CVE-2021-37594?

CVE-2021-37594 has a severity rating of 9.8 (Critical).

Q: How does CVE-2021-37594 affect FreeRDP?

CVE-2021-37594 affects FreeRDP versions up to and excluding 2.4.0 on Windows.

Q: How can I fix CVE-2021-37594?

To fix CVE-2021-37594, it is recommended to update FreeRDP to version 2.4.0 or later.

Q: What are the references for CVE-2021-37594?

The references for CVE-2021-37594 are: [GitHub Commit](https://github.com/FreeRDP/FreeRDP/commit/0d79670a28c0ab049af08613621aa0c267f977e9), [GitHub Comparison](https://github.com/FreeRDP/FreeRDP/compare/2.3.2...2.4.0)

Published Jul 27, 2021

Updated

In FreeRDP before 2.4.0 on Windows, wfcliprdrserverfilecontentsrequest in client/Windows/wfcliprdr.c has missing input checks for a FILECONTENTSSIZE File Contents Request PDU.

Affected Software

4 affected components

FreeRDP freerdp<2.4.0

Microsoft Windows

All of the following

FreeRDP freerdp<2.4.0

Microsoft Windows

Remediation

Patch Available

https://github.com/FreeRDP/FreeRDP/commit/0d79670a28c0ab049af08613621aa0c267f977e9

Event History

Jul 27, 2021

CVE Published

via MITRE·11:33 PM

Data Sourced

via MITRE·11:33 PM

Description

Jul 30, 2021

Data Sourced

via NVD·02:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-37594?

CVE-2021-37594 is a vulnerability in FreeRDP before version 2.4.0 on Windows that allows for missing input checks in the wf_cliprdr_server_file_contents_request function in client/Windows/wf_cliprdr.c, specifically in the FILECONTENTS_SIZE File Contents Request PDU.

What is the severity of CVE-2021-37594?