ALT Linux Team

Branch c9f2 update on 2023-09-27

2023-09-27

ALT-BU-2023-5887-1

Branch c9f2 update bulletin.

ALT-PU-2023-5795-2

Package xrdp updated to version 0.9.23-alt1 for branch c9f2 in task 330055.

Closed vulnerabilities

Published: 2023-08-30
Modified: 2025-02-13

CVE-2023-40184

xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References:
VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.0
Back to top