{"id":"CVE-2021-41159","state":"PUBLISHED","title":"Improper client input validation for FreeRDP gateway connections allows to overwrite memory","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections if possible or use a direct connection without a gateway.","publishedAt":"2021-10-21T00:00:00.000Z","updatedAt":"2024-08-04T02:59:31.631Z","severity":{"score":5.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["FreeRDP FreeRDP"],"affected":[{"vendor":"FreeRDP","product":"FreeRDP","versions":[{"version":"< 2.4.1","status":"affected"}]}],"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vh34-m9h7-95xq","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWJXQOWKNR7O5HM2HFJOM4GBUFPTE3RG/","https://security.gentoo.org/glsa/202210-24"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T19:49:01.697Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/41xxx/CVE-2021-41159.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-41159","state":"PUBLISHED","datePublished":"2021-10-21T00:00:00.000Z","dateUpdated":"2024-08-04T02:59:31.631Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2021-09-15T00:00:00.000Z"},"containers":{"cna":{"title":"Improper client input validation for FreeRDP gateway connections allows to overwrite memory","descriptions":[{"lang":"en","value":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections if possible or use a direct connection without a gateway."}],"affected":[{"vendor":"FreeRDP","product":"FreeRDP","versions":[{"version":"< 2.4.1","status":"affected"}]}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vh34-m9h7-95xq"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWJXQOWKNR7O5HM2HFJOM4GBUFPTE3RG/","name":"FEDORA-2021-2c25f03d0b","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202210-24","name":"GLSA-202210-24","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","type":"CWE","lang":"en","description":"CWE-787: Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2022-10-31T00:00:00.000Z"},"source":{"advisory":"GHSA-vh34-m9h7-95xq","discovery":"UNKNOWN"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vh34-m9h7-95xq","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWJXQOWKNR7O5HM2HFJOM4GBUFPTE3RG/","name":"FEDORA-2021-2c25f03d0b","tags":["vendor-advisory","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202210-24","name":"GLSA-202210-24","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T02:59:31.631Z"}}]}}}