CVE-2022-23478: Out of Bound Write in xrdp
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in xrdpmmtransprocessdrdynvcchannelopen() function. There are no known workarounds for this issue. Users are advised to upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1+deb12u2Fixed in 0.9.21.1-1+deb12u3Fixed in 0.10.1-3.1+deb13u2Fixed in 0.10.6.1-3 - Upgrade
Upgrade
alpine/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-r0 - Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1 - Upgrade
Upgrade
xrdpto a version that resolves this vulnerability.Fixed in 0.9.21
Event History
Frequently Asked Questions
What is CVE-2022-23478?
CVE-2022-23478 is a vulnerability in xrdp version <0.9.21 that allows for an out-of-bounds write in the xrdp_mm_trans_process_drdynvc_channel_open() function.
How does CVE-2022-23478 affect xrdp?
CVE-2022-23478 affects xrdp versions prior to 0.9.21.
What is xrdp?
xrdp is an open source project that provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
What is the severity of CVE-2022-23478?
The severity of CVE-2022-23478 is critical with a CVSS score of 9.8.
How can I fix CVE-2022-23478?
To fix CVE-2022-23478, users should update xrdp to version 0.9.21 or higher.