Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-109949 →
UBUNTU-CVE-2026-109949
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:16.04:LTS
freerdp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
freerdp
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.0+dfsg-0ubuntu0.24.04.1"}]}]
Ubuntu:Pro:24.04:LTS
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.0+dfsg-0ubuntu0.26.04.1"}]}]
Références
- report ubuntu.com
- report cve.org
- report github.com
- report vulncheck.com