| Package | Affected versions | Patched versions |
|---|---|---|
| freerdp | < 3.32.2 | 3.32.2 |
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free