Description
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
FreeRDP FreeRDP
Default version status: unaffected
2.0.0 to < 3.32.0affected3.32.0unaffected