CVE-2022-23483: Out-of-Bound Read in libxrdp
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdpsendtochannel() function. There are no known workarounds for this issue. Users are advised to upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1+deb12u2Fixed in 0.9.21.1-1+deb12u3Fixed in 0.10.1-3.1+deb13u2Fixed in 0.10.6.1-3 - Upgrade
Upgrade
alpine/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-r0 - Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1 - Upgrade
Upgrade
xrdpto a version that resolves this vulnerability.Fixed in 0.9.21
Event History
Frequently Asked Questions
What is CVE-2022-23483?
CVE-2022-23483 is a vulnerability in xrdp, an open source project used for graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
What is the severity of CVE-2022-23483?
The severity of CVE-2022-23483 is critical, with a CVSS score of 9.1.
How does CVE-2022-23483 affect xrdp?
CVE-2022-23483 affects xrdp versions prior to 0.9.21, causing an Out of Bound Read vulnerability in the libxrdp_send_to_channel() function.
Are there any known workarounds for CVE-2022-23483?
There are no known workarounds for CVE-2022-23483, users are advised to upgrade to the latest version of xrdp.
Where can I find more information about CVE-2022-23483?
More information about CVE-2022-23483 can be found at the following references: [GitHub Security Advisory](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-38rw-9ch2-fcxq), [Debian Security Advisory](https://www.debian.org/security/2023/dsa-5502), [GitHub Commit](https://github.com/neutrinolabs/xrdp/commit/35cca701c753db65d3c05b7ea4fff9bd09e76661).