Fedora has issued an advisory on July 9: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7FYD6USHZXDI2EAZVGOVFMAE7ILP3SPL/ The issue is fixed upstream in 0.9.13.1: https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.13.1 The upstream advisory and commit that fixed the issue is linked from the CVE page: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044
Assigning to DavidG as the recent maintainer of this SRPM.
Assignee: bugsquad => geiger.david68210
Debian has issued an advisory for this on July 29: https://www.debian.org/security/2020/dsa-4737
Status comment: (none) => Patch available from upstream and Debian
Done for mga7!
Advisory: ======================== Updated xrdp packages fix security vulnerability: Ashley Newson discovered that the XRDP sessions manager was susceptible to denial of service. A local attacker can further take advantage of this flaw to impersonate the XRDP sessions manager and capture any user credentials that are submitted to XRDP, approve or reject arbitrary login credentials or to hijack existing sessions for xorgxrdp sessions (CVE-2020-4044). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044 https://www.debian.org/security/2020/dsa-4737 ======================== Updated packages in core/updates_testing: ======================== xrdp-0.9.10-1.1.mga7 xrdp-devel-0.9.10-1.1.mga7 from xrdp-0.9.10-1.1.mga7.src.rpm
Assignee: geiger.david68210 => qa-bugsCC: (none) => geiger.david68210Status comment: Patch available from upstream and Debian => (none)
Severity: normal => major
$ uname -r 5.7.19-desktop-3.mga7 The following 4 packages are going to be installed: - tigervnc-server-1.10.1-1.2.mga7.x86_64 - vnc-server-common-1.0-8.mga7.noarch - xrdp-0.9.10-1.1.mga7.x86_64 - xrdp-devel-0.9.10-1.1.mga7.x86_64 --- set up xrdp services under services --- able to connect using remote desktop. chose xvnc for renderer of gnome, it works fine. # ps -ef | grep rdp root 2968 1 0 18:22 ? 00:00:00 /usr/sbin/xrdp-sesman --nodaemon root 2969 1 0 18:22 ? 00:00:00 /usr/sbin/xrdp --nodaemon root 5563 2969 2 19:04 ? 00:00:09 /usr/sbin/xrdp --nodaemon root 5568 2968 0 19:05 ? 00:00:00 /usr/sbin/xrdp-sesman --nodaemon brian 5583 5568 0 19:05 ? 00:00:00 /usr/sbin/xrdp-chansrv
Whiteboard: (none) => MGA7-64-OKCC: (none) => brtians1
Validating, Advisory pushed to SVN.
Keywords: (none) => advisory, validated_updateCVE: (none) => CVE-2020-4044CC: (none) => ouaurelien, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0016.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED