CVE-2022-23481: Out-of-Bound Read in xrdp
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdpcapsprocessconfirmactive() function. There are no known workarounds for this issue. Users are advised to upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1+deb12u2Fixed in 0.9.21.1-1+deb12u3Fixed in 0.10.1-3.1+deb13u2Fixed in 0.10.6.1-3 - Upgrade
Upgrade
alpine/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-r0 - Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1 - Upgrade
Upgrade
xrdpto a version that resolves this vulnerability.Fixed in 0.9.21
Event History
Frequently Asked Questions
What is CVE-2022-23481?
CVE-2022-23481 is a vulnerability in xrdp, an open-source project that provides graphical login to remote machines using Microsoft RDP.
How does CVE-2022-23481 affect xrdp?
CVE-2022-23481 affects xrdp versions prior to 0.9.21 and can lead to an out-of-bounds read in the xrdp_caps_process_confirm_active() function.
What is the severity of CVE-2022-23481?
CVE-2022-23481 has a severity rating of 9.1, which is considered critical.
Is there a workaround for CVE-2022-23481?
There are currently no known workarounds for CVE-2022-23481. Users are advised to upgrade to xrdp version 0.9.21 or higher.
How do I fix CVE-2022-23481?
To fix CVE-2022-23481, you should upgrade xrdp to version 0.9.21 or later.