FreeRDPに証明書検証の脆弱性、3.32.2で修正
Summary
FreeRDPのクライアントが接続先の証明書を正しく確認せず、なりすましのサーバーに接続するおそれがあります。FreeRDPを使うクライアントやゲートウェイを洗い出し、3.32.2以降に更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
FreeRDPのクライアントが接続先の証明書を正しく確認せず、なりすましのサーバーに接続するおそれがあります。FreeRDPを使うクライアントやゲートウェイを洗い出し、3.32.2以降に更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| FreeRDP | FreeRDP |
< 3.32.2 |
3.32.2 |
Fix status by distribution
Fixed packages published by each distribution for this CVE Fixed versions differ by release; check each link.
- Debian DEBIAN-CVE-2026-121392 freerdp2
- Ubuntu UBUNTU-CVE-2026-121392 freerdp
Original description The description as published by the source.
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- REDHAT Red Hat
- web github.com