CVE-2021-41159

Medium

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections if possible or use a direct connection without a gateway.

SeverityMedium

CVSS5.8

Exploit probability—

Product

Freerdp

PublishedOct 21, 2021

First seenOct 21, 2021

Weakness typeCWE-787Out-of-bounds write

How to fix

Update

freerdp freerdp2.4.1 or later

Vendor advisories

Affected products

Product	Affected versions	Fixed in
freerdp freerdp	v < 2.4.1	2.4.1
fedoraproject fedora	35	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.