Security update for freerdp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2352-1 Final 1 1 2022-07-11T10:06:30Z current 2022-07-11T10:06:30Z 2022-07-11T10:06:30Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for freerdp This update for freerdp fixes the following issues: - CVE-2022-24882: Fixed incorrect check parameters in NTLM (bsc#1198919). - CVE-2022-24883: Fixed authentication against invalid SAM files (bsc#1198921). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2352,SUSE-SLE-SDK-12-SP5-2022-2352,SUSE-SLE-WE-12-SP5-2022-2352 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222352-1/ Link for SUSE-SU-2022:2352-1 https://lists.suse.com/pipermail/sle-security-updates/2022-July/011498.html E-Mail link for SUSE-SU-2022:2352-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1198919 SUSE Bug 1198919 https://bugzilla.suse.com/1198921 SUSE Bug 1198921 https://www.suse.com/security/cve/CVE-2022-24882/ SUSE CVE CVE-2022-24882 page https://www.suse.com/security/cve/CVE-2022-24883/ SUSE CVE CVE-2022-24883 page SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 freerdp-2.1.2-12.23.1 freerdp-devel-2.1.2-12.23.1 freerdp-proxy-2.1.2-12.23.1 freerdp-server-2.1.2-12.23.1 freerdp-wayland-2.1.2-12.23.1 libfreerdp2-2.1.2-12.23.1 libuwac0-0-2.1.2-12.23.1 libwinpr2-2.1.2-12.23.1 uwac0-0-devel-2.1.2-12.23.1 winpr2-devel-2.1.2-12.23.1 freerdp-devel-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libfreerdp2-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libwinpr2-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 winpr2-devel-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 freerdp-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 freerdp-proxy-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 freerdp-server-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libfreerdp2-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libwinpr2-2.1.2-12.23.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds. CVE-2022-24882 SUSE Linux Enterprise Software Development Kit 12 SP5:freerdp-devel-2.1.2-12.23.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libfreerdp2-2.1.2-12.23.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libwinpr2-2.1.2-12.23.1 SUSE Linux Enterprise Software Development Kit 12 SP5:winpr2-devel-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-proxy-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-server-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libfreerdp2-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libwinpr2-2.1.2-12.23.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222352-1/ https://www.suse.com/security/cve/CVE-2022-24882.html CVE-2022-24882 https://bugzilla.suse.com/1198919 SUSE Bug 1198919 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left. CVE-2022-24883 SUSE Linux Enterprise Software Development Kit 12 SP5:freerdp-devel-2.1.2-12.23.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libfreerdp2-2.1.2-12.23.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libwinpr2-2.1.2-12.23.1 SUSE Linux Enterprise Software Development Kit 12 SP5:winpr2-devel-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-proxy-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-server-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libfreerdp2-2.1.2-12.23.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libwinpr2-2.1.2-12.23.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222352-1/ https://www.suse.com/security/cve/CVE-2022-24883.html CVE-2022-24883 https://bugzilla.suse.com/1198921 SUSE Bug 1198921